You can either enable syslog on the device. Then, when someone exits config mode, you will get a %SYS-5-CONFIG_I message. To enable syslog, simply configure a syslog destination server:
logging 10.1.1.1
Or you can enable SNMP traps. Then, all configuration operations will generate a trap from the CISCO-CONFIG-MAN-MIB. To enable traps, configure a trap host, and enable configuration traps:
snmp-server enable traps config
snmp-server host 10.1.1.1 public