Rules are added to auditd to log all attempts to change the system time using /etc/localtime.
/etc/localtime