On Red Hat Linux I can specify the file I want to record audit logs for with this command:
auditctl -a exit,always -F path=/tmp/foo.txt -F perm=war
I cannot figure out how to do a similar thing on FreeBSD. The only way I've found to record audit logs for files is to add the fr flag to my /etc/security/audit_control file.
Unfortunately, this way doesn't allow me to specify the file.
Update 1:
I asked about it on the trustedbsd-discuss mailing list. You can view the email here. I did not receive any answer yet.
