How to monitor file access on Linux with auditd