Actions Monitor 

Monitor, display, and save all file system activity that has occurred on a system.
security actions monitor