linux audit with auditd or audit

First section non-systemd linux, second section systemd linux.

For non-systemd linux:

http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

install audit

start on boot

ntsysv
or
chkconfig auditd on

/etc/init.d/auditd start

auditctl -w "/media/Office-Files/Files/a-PI/Clients" -p rwxa

ausearch -f "/media/Office-Files/Files/a-PI/Clients" -i | less

For systemd linux:

https://www.linux.com/learn/linux-system-monitoring-and-more-auditd

https://www.linux.com/learn/customized-file-monitoring-auditd

With distribution install audit or auditd

sudo systemctl status auditd.service
sudo systemctl start auditd.service
sudo systemctl enable auditd.service #to run at boot

sudo aureport