This option audits successful changes to system and configuration files, allowing you to reconstruct events after the fact ...