[CentOS] Watching a file using auditd