How to Monitor File Changes

Using auditd

sudo auditctl -w /etc/passwd -p wa -k passwd_monitor
sudo auditctl -w /etc/group -p wa -k group_monitor
sudo auditctl -w /var/www -p rwxa -k web_files

View Change Logs

sudo ausearch -k passwd_monitor

Using inotify (Alternative)

sudo apt install inotify-tools
inotifywait -m -r -e modify,create,delete /etc/nginx