Detecting insiders on GNU/Linux servers

Yet another auditd ruleset