Enabling Audit

Your first task enabling audit is to activate system call auditing, since system call auditing capabilities are needed even when you are only configuring plain file or directory watches:

Enabling System Call Auditing for One Session Only

Enable with auditctl -e 1 and disable with auditctl -e 0. These settings are not persistent and do not survive a reboot.

Enabling System Call Auditing Permanently

Permanently enable audit contexts for system calls by changing AUDITD_DISABLE_CONTEXTS in /etc/sysconfig/auditd from yes to no. To permanently disable audit contexts for system calls, revert this setting to yes. THis configuration will be applied with the next start of the audit daemon.