Add this to a file, make it executable, then set up a cron for a daily run:
#!/bin/bash
date=$(date)
echo "##################################################" >> /var/log/file_change.log
echo $date >> /var/log/file_change.log
echo "##################################################" >> /var/log/file_change.log
find / -mtime -1 >> /var/log/file_change.log
Adding to cron:
crontab -e
add this line (replacing the file path to the actual path/name)
00 02 * * * /root/file_integrity_monitor.sh
Making exeutable (change path and file name, of course):
chmod +x /root/file_integrity_monitor.sh
Sorry for the delay. It will create a log file that looks something like this:
##################################################
Mon Jun 27 17:38:55 UTC 2015
##################################################
/etc/httpd/logs/httpd.log
/var/log/some_file.log
/var/log/mail.log
/var/log/err.log
##################################################
Mon Jun 28 17:38:55 UTC 2015
##################################################
/etc/httpd/logs/httpd.log
/var/log/some_file.log
/var/log/mail.log
/var/log/err.log
##################################################
Mon Jun 29 17:38:55 UTC 2015
##################################################
/etc/httpd/logs/httpd.log
/etc/passwd
/var/log/some_file.log
/var/log/mail.log
/var/log/err.log
Now, in the example above, if you were to see the change in the last set of messages (/etc/passwd), it would be time to start worrying.
If it's log files, that's to be expected. Other files are on a case-by-case basis.