The company I work for is currently investigating the deployment of an centralized automation system (like Salt or Puppet) for our servers (all Ubuntu/FreeBSD). We will probably go along with Salt, but I think it is irrelevant to my question.
My quesiton: Is there a good way for monitoring machines for local changes not included in the automation system?
For example: for a quick fix, someone started a service or modified a configuration file on a given machine. Is there a way to check for such things using Salt/Puppet/whatever? Or do I need to use external programs like AIDE for that?