If Bob tries to access something like
/home/Code/TopSecret for example. The system wouldn't allow him to access this without having the permission. I would like to know about these attempts.
Is there a way I can monitor and view these attempts by either modifying
auditctl? Or, if it is already being monitored, where would I view these attempts?
Thank you in advance.