You have to enable auditing
# vim /etc/audit/rules.d/audit.rules - mention your rules here
# systemctl restart auditd.service - start the service
# cat /var/log/audit/audit.log - logs location will be here
You have to enable auditing
# vim /etc/audit/rules.d/audit.rules - mention your rules here
# systemctl restart auditd.service - start the service
# cat /var/log/audit/audit.log - logs location will be here