auditctl rule to monitor dir only (not all sub dir and files etc..)