Security

Linux Audit Logs with auditd

December 16, 2025·2 min read

auditd is the Linux audit framework — kernel-level monitoring of syscalls and filesystem access, with rules written by you and a log readable by humans. It's how compliance regimes (PCI, HIPAA, the various govt standards) get satisfied, and it's quietly useful even when nobody is forcing you.

Install and enable

apt install auditd                     # Debian/Ubuntu
dnf install audit                       # RHEL/Fedora
systemctl enable --now auditd

Rules go in /etc/audit/rules.d/*.rules. The active ruleset is loaded with augenrules --load.

Watching files

# /etc/audit/rules.d/security.rules
-w /etc/passwd  -p wa -k identity
-w /etc/shadow  -p wa -k identity
-w /etc/group   -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd_config

# -w = watch this path
# -p wa = on write (w) or attribute change (a) — also r, x
# -k = a tag you'll use to find these events later

Watching syscalls

# Any time someone executes a binary in /tmp
-a always,exit -F arch=b64 -S execve -F dir=/tmp/ -k tmp_exec

# Any failed open() — useful for hunting permission probing
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -k access_denied

# Time changes
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time_change

Querying logs

ausearch -k identity                          # by tag
ausearch -k sudoers --start today
ausearch -ua alice                            # by user
ausearch -m USER_LOGIN --start yesterday
aureport --summary
aureport --user --summary
aureport --auth                               # auth events summary

Sensible defaults to ship with

# /etc/audit/rules.d/baseline.rules
# Delete all current rules
-D
# Buffer
-b 8192
# Failure mode (1 = printk, 2 = panic) — 1 in production
-f 1

# Identity
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd_config

# Time
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time_change
-w /etc/localtime -p wa -k time_change

# Kernel modules
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-a always,exit -F arch=b64 -S init_module,delete_module -k modules

# Login records
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

# Lock the ruleset until reboot
-e 2

Forwarding off-host

auditd logs to /var/log/audit/audit.log by default. For real auditing you want logs shipped off the host (otherwise an attacker who roots the box edits the logs). audisp-syslog forwards to syslog, which your collector then ships to a SIEM. audisp-remote sends directly to another audit daemon.

Performance

Audit rules have overhead per matched event. Watching every file write on a busy server is expensive. Audit selectively — system files, sudo-controlled paths, anything compliance asks for. Don't audit your application's data directory.