[root@rhel9 ~]# auditctl -a always,exit -F arch=b64 -S creat -F path=/etc/ssh/sshd_config -F perm=wa

[root@rhel9 ~]# auditctl -l
-a always,exit -F arch=b64 -S open,bind,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown,mknod,acct,swapon,quotactl,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr,openat,mkdirat,mknodat,fchownat,unlinkat,renameat,linkat,symlinkat,fchmodat,fallocate,renameat2,openat2 -F path=/etc/ssh/sshd_config -F perm=wa