# ausearch -k hosts-file -ts today -ul 1000
----
time->Tue Jul 1 16:36:00 2014
type=PATH msg=audit(1404225360.791:124138): item=0 name="/etc/hosts"
  inode=2755966 dev=fd:02 mode=0100644 ouid=0 ogid=0 rdev=00:00
  obj=system_u:object_r:net_conf_t:s0 nametype=NORMAL type=CWD
  msg=audit(1404225360.791:124138): cwd="/home/tscherf"
type=SYSCALL msg=audit(1404225360.791:124138): arch=c000003e syscall=2
  success=yes exit=3 a0=7fff67b1e9fc a1=0 a2=1fffffffffff0000 a3=3109e85ad0
  items=1 ppid=7144 pid=11992 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000
  fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts6 ses=1748 comm="cat"
  exe="/usr/bin/cat" subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key="hosts-file"