MTIME - File Monitoring

Hi,

I am trying to monitor files which should NOT be modified.

If have the MTIME parameter setup as follows:

FILE /etc/passwd TYPE=file OWNER=0 GROUP=0 MODE=644 MTIME>86400 red

This basically means that if the file is modified within the last 24 hours, it should go red...

It never goes to any other status other than green.

I also have the /etc/passwd entry in the clients-local.cfg file as well\

Any Ideas?