Use ausearch to view the audit log.

For example, to see the audit log against the /etc/passwd file (assuming that a rule had been added to watch the /etc/passwd file):

sudo ausearch -f /etc/passwd

Result:

<no matches>

or

time->Mon Dec 22 09:39:16 2014
type=PATH msg=audit(1419215956.471:194): item=0 name="/etc/passwd" inode=142512 dev=08:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1419215956.471:194): cwd="/home/peter"
type=SYSCALL msg=audit(1419215956.471:194): arch=40000003 syscall=5 success=yes exit=3 a0=b779694b a1=80000 a2=1b6 a3=b8776aa8 items=1 ppid=2090 pid=2231 auid=4294967295 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=4294967295 comm="sudo" exe="/usr/bin/sudo" key=(null)

• time ; is when the audit is done.
• name ; is the object name to be audited.
• cwd ; is the current directory.
• syscall ; is related syscall.
• auid ; is the audit user ID.
• uid and gid ; are User ID and Group ID of the user who access the file.
• comm ; is the command that the user is used to access the file.
• exe ; is the location of the command of comm parameter above.

This is how auditd records the activity to the /etc/passwd file when a new user is added:

time->Mon Dec 22 11:25:23 2014
type=PATH msg=audit(1419222323.628:510): item=1 name="/etc/passwd.lock" inode=143992 dev=08:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
type=PATH msg=audit(1419222323.628:510): item=0 name="/etc/" inode=131073 dev=08:01 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
type=CWD msg=audit(1419222323.628:510): cwd="/root"
type=SYSCALL msg=audit(1419222323.628:510): arch=40000003 syscall=10 success=yes exit=0 a0=bfc0ceec a1=0 a2=bfc0ceec a3=897764c items=2 ppid=2978 pid=2994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="chfn" exe="/usr/bin/chfn" key=(null)

As e can be seen, that at the particular time, /etc/passwd was accessed by user root (uid = 0 and gid = 0) from directory /root (cwd = /root). The /etc/passwd file was accessed using the chfn command which is located in /usr/bin/chfn.

If we type man chfn on the console, we will see more detail about what is chfn.