I'd like to audit the insertion and removal of all USB devices but I'm not sure where to start. Do I need to be auditing a specific syscall, should it be a udev configuration? Any tips would be greatly appreciated. Thanks, -josh