auditd is a Unix-centric process. Kind of like ACLs though. They all have it, but they all have slightly different ways of enabling and managing.
>
- [ossec-list] Identifying user that made change to file ... mcrane0
- Re: [ossec-list] Identifying user that made change... dan (ddp)
- Re: [ossec-list] Identifying user that made ch... mcrane0
- Re: [ossec-list] Identifying user that mad... dan (ddp)
- Re: [ossec-list] Identifying user that... mcrane0
- Re: [ossec-list] Identifying user... Kat
- Re: [ossec-list] Identifying ... dan (ddp)
- Re: [ossec-list] Identify... Kat
- Re: [ossec-list] Identifying ... Christopher Decker
