Two different approaches could be used.
File integrity monitoring.
Host based intrusion detection software such as AIDE can be configured to record hashes of important files on the system and then perform periodic scans to report on files that have changed. In your case, if the contractors sometimes have root access, some steps would need to be taken to ensure they could not modify the hashes to avoid changes being detected.
The Linux auditd
auditd Daemon can be configured to log all commands run by an administrator. As described in this question;
In this case it would be wise to use syslog to send the logs to a remote server that the contractors do not have access to in order to.prevent prevent them tampering with the logs.