Qusetion on logging file deletions with auditd

What would the appropriate syscall be in the audit.rules file to log file deletions with auditd? I'm thinking the syntax would be something akin to -w entry, always -S delete, but that doesn't seem to work...

Thanks to all...

Assuming current upstream kernel...In terms of watches, I think deletion is considered a write. But if you audit writes like this:

auditctl -w /var/log/messages -p w -k delete-logs

you will likely get more than you asked for. So, you could do it this way:

auditctl -a exit,always -S unlink -F path=/var/log/messages -F key=delete-logs

and then find them with:

ausearch --start today -k delete-logs

-Steve