Tracking root and /, how to organize?

Question

System administration

Good afternoon, there is a need to monitor / , with log entry filters: creating, modifying, deleting and reading files,
as well as tracking users, for example, what opened, what changed, what deleted, what file was created.

Answer 1

enable auditing. there is an inotify package, there is a simple check for hash sums

Answer 2

Search Google for: "auditd linux".
Here you will find: xakep.ru/2011/03/30/54897

Answer 3

sudo+rsync. You can try sudo who did what, rsync to collect changes in files.