/etc/passwd Monitoring of Solaris Xymon Clients

Is there an established way of monitoring for /etc/passwd entriy
changes/additions on Solaris servers?

If not, is it possible to add it as a log to be fetched and then do
some processing on the Xymon server?

Regards,

Nick Pettefar