I'll second AIDE. schedule it to run daily. All changes are reported to the cron email address. We do it to most of the file system just not the parts that you expect to change often eg. /var/log ... that is configured in aide's conf file.