hi,
why don't you write a simple script which checks if the file has been modified , if so send an alert or an email
you can use the find comand with -newer option
i.e. find /etc -name passwd -newer filename -exec run_script {} \;
filename gets run when your check file script gets run and
touches a file with date stamp and if the passwd file has greater timestamp than your file filename then send an alert/email otherwise do nothing
HTH