in reply to Re: /etc/shadow logging
in thread /etc/shadow logging

If that doesn't work, they could use the low tech version of having a cron job compare the current value against the last known value.