auditing files which are executed?