-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
