Auditd Report is typically installed with most Centos.

Auditd can look at logs to see what system files like /etc/passwd got modified log whom logged in.

So the 2 commands to generate reports are

# /sbin/aureport –input-logs -m -ts today

-m will tell you what system files got edited

# /sbin/aureport –input-logs -au -ts today

-au will tell you whom logged in.

–input-logs is need if the commands are ran from cron.

So create a file with those 2 command in /var/log/audit/auditreport.sh

Then make it executable by chmod 700 /var/log/audit/auditreport.sh

Then edit crontab to run it and mail the output by “crontab -e” and add the line below.

59 23 * * * /var/log/audit/auditreport.sh | mail -s “servername Audit Report” customer-email@email.com