Record Attempts to Alter Time Through stime
If the 'auditd' daemon is configured to use the
'augenrules' program to read audit rules during daemon startup (the
default), add the following line to a file with suffix '.rules' in the
directory '/etc/audit/rules.d' for both 32 bit and 64 bit systems:
'-a always,exit -F arch=b32 -S stime -k audit_time_rules'
Since the 64 bit version of the "stime" sys ...