So in the answers please spec out what you want to accomplish and I'll try to build out an auditd config to match and publish it on the blog.
I have an assignment to provide
auditd monitoring for a client's server.
The customer has a production Linux server running an ERP application whose source code resides on the server. The standard practice for this product is for programmers to make ad-hoc changes to the code on the production system!!
The client has established a dedicated test environment on another server and would like for me to monitor three specific directories on the production system for changes to the source code and compiled executables. They've had bad code pushed into production in the past, but there was no audit trail/accountability. This is how they would like to enforce the wall between test and production.
The final requirement is for auditd to sense automatic email notification of changes to the monitored directories.