ausearch -k

ausearch -k passwd_changes

Retrieves from the auditd log all events recorded under a search key, with process, identity, and result details.

Run it when the integrity alert (the watched file rule) fires and you need the details: ausearch -k passwd_changes returns the events with that key, and expanding with -i (interpret IDs) and -ts (time window) builds the exact timeline of who touched what. It's the second half of the audit flow: auditctl watches, ausearch investigates. In an IR, it's the tool that answers 'was /etc/passwd touched last night?' with the list of processes, uids, and timestamps without relying on the SIEM.

Don't use it if the audit log rotates quickly or is forwarded without local retention: older events may not be there. The key depends on the rule being loaded with -k — if the rule was set without a key or the host rebooted without loading the rules, ausearch finds nothing even though the event occurred. And beware: ausearch searches /var/log/audit/audit.log; if auditd is stopped (something an attacker with root does before touching files), there are no events to search — the absence of log is also a finding.