System Auditing (auditd)

auditd (Linux Audit Daemon) is a kernel-level security auditing framework for Linux that can record system calls, file access, user operations, and other critical events. It is an essential tool for meeting security compliance requirements such as PCI-DSS, HIPAA, and similar standards.

auditd Basics

Install auditd

Most enterprise Linux distributions come with auditd pre-installed. If it is not installed:

sudo dnf install audit audit-libs -y

Start the auditd Service

sudo systemctl enable --now auditd

Check the service status:

sudo systemctl status auditd

Note

auditd is special in that you cannot use systemctl restart auditd to restart it. Instead, use sudo service auditd restart. To merely reload rules (rather than restart the service), use sudo augenrules --load; auditctl -R <file> also loads a given rules file, but it only loads rules — it is not equivalent to restarting the service.

auditd Component Overview

Component	Description
auditd	Audit daemon, responsible for writing audit events to the log
auditctl	Audit rule management tool (temporary rules)
ausearch	Audit log search tool
aureport	Audit log report generation tool
/etc/audit/auditd.conf	auditd service configuration file
/etc/audit/rules.d/	Persistent audit rules directory
/var/log/audit/audit.log	Audit log file

Managing Rules with auditctl

auditctl is used to add, delete, and view audit rules at runtime. Rules added via auditctl are temporary and will be lost after a reboot.

View Current Rules

sudo auditctl -l

Check Audit System Status

sudo auditctl -s

Audit Rule Types

auditd supports three types of rules:

1. File system rules (-w): Monitor file or directory access
2. System call rules (-a): Monitor specific system calls
3. Control rules (-e, -b, etc.): Control audit system behavior

Monitoring File Access

File System Rule Syntax

-w path -p permissions -k keyword

Permission flags:

Flag	Description
r	Read
w	Write
x	Execute
a	Attribute change

Monitor Critical Configuration Files

# Monitor all modifications to /etc/passwd
sudo auditctl -w /etc/passwd -p wa -k identity

# Monitor all access to /etc/shadow
sudo auditctl -w /etc/shadow -p rwa -k identity

# Monitor modifications to /etc/sudoers
sudo auditctl -w /etc/sudoers -p wa -k sudoers_change

# Monitor modifications to /etc/ssh/sshd_config
sudo auditctl -w /etc/ssh/sshd_config -p wa -k sshd_config

# Monitor modifications to /etc/hosts
sudo auditctl -w /etc/hosts -p wa -k hosts_change

Monitor Entire Directories

# Monitor all file modifications under /etc/audit/
sudo auditctl -w /etc/audit/ -p wa -k audit_config

# Monitor cron configuration
sudo auditctl -w /etc/cron.d/ -p wa -k cron_change
sudo auditctl -w /etc/crontab -p wa -k cron_change

Monitoring Command Execution

System Call Rule Syntax

-a action,filter -S syscall -F field=value -k keyword

Common parameters:

Parameter	Description
-a always,exit	Always log when the system call exits
-S	Specify system call name or number
-F arch=b64	64-bit system architecture
-F uid=0	Filter by user ID
-F auid>=1000	Filter by audit UID (actual login user)
-F auid!=-1	Exclude non-login users (system processes)
-k	Keyword tag for later searching

Monitor Privileged Commands

# Monitor sudo usage
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/sudo -k privilege_escalation

# Monitor su usage
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/su -k privilege_escalation

# Monitor passwd command
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/passwd -k password_change

Monitor User Management Commands

# Monitor user and group management commands
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/sbin/useradd -k user_management
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/sbin/userdel -k user_management
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/sbin/usermod -k user_management
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/sbin/groupadd -k user_management

Monitor File Deletion Operations

sudo auditctl -a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k file_deletion

Monitor Network Connections

sudo auditctl -a always,exit -F arch=b64 -S connect -F auid>=1000 -F auid!=-1 -k network_connect

Delete Rules

# Delete all temporary rules
sudo auditctl -D

# Delete a specific file monitoring rule
sudo auditctl -W /etc/passwd -p wa -k identity

Persistent Rules: /etc/audit/rules.d/

Temporary rules are lost after a reboot. To make rules persistent, they must be written to files in the /etc/audit/rules.d/ directory.

Create a Rules File

sudo vi /etc/audit/rules.d/custom.rules

Add the following content:

# Clear existing rules
-D

# Set audit buffer size
-b 8192

# Set failure handling mode (0=silent, 1=print, 2=panic)
-f 1

# ========== File Access Monitoring ==========
# Identity files
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/gshadow -p wa -k identity

# SSH configuration
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /etc/ssh/sshd_config.d/ -p wa -k sshd_config

# Privilege escalation configuration
-w /etc/sudoers -p wa -k sudoers_change
-w /etc/sudoers.d/ -p wa -k sudoers_change

# Audit configuration itself
-w /etc/audit/ -p wa -k audit_config
-w /var/log/audit/ -p wa -k audit_log

# Network configuration
-w /etc/hosts -p wa -k network_config
-w /etc/sysconfig/network-scripts/ -p wa -k network_config   # EL8/EL9 only; EL10 removed network-scripts, connections live in /etc/NetworkManager/system-connections/
-w /etc/NetworkManager/system-connections/ -p wa -k network_config

# Scheduled tasks
-w /etc/crontab -p wa -k cron_change
-w /etc/cron.d/ -p wa -k cron_change
-w /var/spool/cron/ -p wa -k cron_change

# ========== Command Execution Monitoring ==========
# Privileged commands
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/sudo -k privilege_escalation
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/su -k privilege_escalation

# User management
-a always,exit -F arch=b64 -S execve -F path=/usr/sbin/useradd -k user_management
-a always,exit -F arch=b64 -S execve -F path=/usr/sbin/userdel -k user_management
-a always,exit -F arch=b64 -S execve -F path=/usr/sbin/usermod -k user_management

# File deletion
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k file_deletion

# System time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k time_change

# ========== Lock Rules (place at the end) ==========
# Uncomment the following line to prevent rules from being modified at runtime (requires reboot to change rules)
# -e 2

Load Persistent Rules

sudo augenrules --load

Or restart auditd:

sudo service auditd restart

Verify that the rules have been loaded:

sudo auditctl -l

Danger

-e 2 locks the audit rules, and any rule changes will require a system reboot to take effect. Only enable this option after the rules are fully finalized.

Searching Audit Logs with ausearch

ausearch is a powerful search tool for audit logs.

Search by Keyword

# Search for identity file change events
sudo ausearch -k identity

# Search for privilege escalation events
sudo ausearch -k privilege_escalation

Search by Time Range

# Search for today's events
sudo ausearch -k identity -ts today

# Search for events in the last hour
sudo ausearch -k identity -ts recent

# Search a specific time range
sudo ausearch -ts 03/24/2026 09:00:00 -te 03/24/2026 18:00:00

Search by User

# Search for a specific user's actions
sudo ausearch -ua 1000

# Search for root user's actions
sudo ausearch -ua 0

Search by Event Type

# Search for login events
sudo ausearch -m USER_LOGIN

# Search for authentication events
sudo ausearch -m USER_AUTH

# Search for system call events
sudo ausearch -m SYSCALL -k file_deletion

Interpret Audit Logs

# Output in human-readable format
sudo ausearch -k identity -i

The -i flag converts UIDs, GIDs, system call numbers, and more into human-readable names.

Search Access Records for a Specific File

sudo ausearch -f /etc/passwd
sudo ausearch -f /etc/shadow -i

Generating Reports with aureport

aureport generates various audit statistical reports.

Generate a Summary Report

sudo aureport --summary

Common Report Types

# Authentication report
sudo aureport -au

# Login report
sudo aureport -l

# Failed authentication report
sudo aureport -au --failed

# File access report
sudo aureport -f

# Executable file report
sudo aureport -x

# User report
sudo aureport -u

# System call report
sudo aureport -s

# Anomaly report
sudo aureport --anomaly

# Report by keyword
sudo aureport -k

Time-Scoped Reports

sudo aureport -au -ts today
sudo aureport -l -ts 03/24/2026 09:00:00 -te 03/24/2026 18:00:00

Combining ausearch and aureport

You can pipe ausearch results into aureport:

# View today's failed login details
sudo ausearch -m USER_LOGIN --failed -ts today | aureport -l

# View file access statistics for a specific keyword
sudo ausearch -k identity | aureport -f --summary

auditd Configuration File

/etc/audit/auditd.conf Core Configuration

sudo vi /etc/audit/auditd.conf

Key parameters:

# Log file path
log_file = /var/log/audit/audit.log

# Log format (RAW or ENRICHED)
log_format = ENRICHED

# Maximum size of a single log file (MB)
max_log_file = 50

# Action when max size is reached (ROTATE, SYSLOG, SUSPEND, KEEP_LOGS)
max_log_file_action = ROTATE

# Number of log files to retain
num_logs = 10

# Actions when disk space is low
space_left = 75
space_left_action = SYSLOG
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND

Tip

For production environments, it is recommended to set log_format to ENRICHED, which includes human-readable information such as usernames and group names in the logs for easier analysis. Also ensure that adequate log rotation policies are configured to prevent audit logs from filling up the disk.

Hands-On: Deploying an Audit Policy

1. Confirm auditd is installed and running:

   sudo dnf install audit -y
   sudo systemctl enable --now auditd
   sudo auditctl -s

2. Create an audit rules file:

   sudo tee /etc/audit/rules.d/security.rules <<'EOF'
   -D
   -b 8192
   -f 1
   
   # Identity file monitoring
   -w /etc/passwd -p wa -k identity
   -w /etc/shadow -p wa -k identity
   -w /etc/group -p wa -k identity
   -w /etc/sudoers -p wa -k sudoers_change
   -w /etc/sudoers.d/ -p wa -k sudoers_change
   
   # SSH configuration monitoring
   -w /etc/ssh/sshd_config -p wa -k sshd_config
   
   # Privileged command monitoring
   -a always,exit -F arch=b64 -S execve -F path=/usr/bin/sudo -k privilege_escalation
   -a always,exit -F arch=b64 -S execve -F path=/usr/bin/su -k privilege_escalation
   
   # User management command monitoring
   -a always,exit -F arch=b64 -S execve -F path=/usr/sbin/useradd -k user_mgmt
   -a always,exit -F arch=b64 -S execve -F path=/usr/sbin/userdel -k user_mgmt
   -a always,exit -F arch=b64 -S execve -F path=/usr/sbin/usermod -k user_mgmt
   
   # File deletion monitoring
   -a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k file_deletion
   EOF

3. Load the rules:

   sudo augenrules --load
   sudo auditctl -l

4. Test that auditing is working correctly:

   # Modify a monitored file
   sudo touch /etc/passwd
   
   # Search for the corresponding audit record
   sudo ausearch -k identity -ts recent -i

5. Generate daily audit reports:

   # Summary report
   sudo aureport --summary -ts today
   
   # Authentication report
   sudo aureport -au -ts today
   
   # Keyword report
   sudo aureport -k -ts today

6. Optional: Set up an automatic daily report (add a cron job):

   sudo tee /etc/cron.daily/audit-report <<'EOF'
   #!/bin/bash
   aureport --summary -ts yesterday -te today > /var/log/audit/daily-report-$(date +%Y%m%d).txt
   aureport -au --failed -ts yesterday -te today >> /var/log/audit/daily-report-$(date +%Y%m%d).txt
   EOF
   sudo chmod +x /etc/cron.daily/audit-report

auditd is the cornerstone of Linux system security auditing. By properly configuring audit rules, you can comprehensively track critical operations on the system, providing reliable data for security incident investigation and compliance auditing.