nevermind; I found "man auditctl" and I think I can piece the two together.