auditctl

Control and manage Linux audit system rules.

TLDR

Show status

$ sudo auditctl -s

List all rules

$ sudo auditctl -l

Delete all rules

$ sudo auditctl -D

Enable/disable auditing

$ sudo auditctl -e 1

Watch file for changes

$ sudo auditctl -a always,exit -F arch=b64 -F path=/path/to/file -F perm=wa

Watch directory recursively

$ sudo auditctl -a always,exit -F arch=b64 -F dir=/path/to/dir/ -F perm=wa

Watch file with a filter key for easy searching

$ sudo auditctl -w /etc/passwd -p wa -k passwd_changes

Delete a specific rule

$ sudo auditctl -W /etc/passwd

auditctl controls the behavior and manages rules of the Linux Auditing System. It can enable or disable auditing, add or remove audit rules, and display the current audit status and configuration.Rules can monitor specific files and directories for access, track system calls by process attributes, and filter events by user, group, or architecture. The tool communicates directly with the kernel audit subsystem to apply rules immediately, though these runtime rules are lost on reboot unless persisted to the audit rules file.

PARAMETERS

-s

Display the audit system status

-l

List all currently loaded audit rules

-D

Delete all audit rules

-b backlog

Set max number of outstanding audit buffers (kernel default: 64)

-e 0|1|2

Disable (0), enable (1), or lock (2) audit configuration. Locked config cannot be changed without reboot.

-f 0|1|2

Set failure mode: 0=silent, 1=printk, 2=panic

-r rate

Set message rate limit in messages/sec (0=none)

-a list,action

Append a rule to the end of a list (e.g., always,exit)

-d list,action

Delete a matching rule from the specified list

-w path

Place a watch on a file or directory for changes

-W path

Remove a watch from a file or directory

-F field=value

Add a field comparison (path, perm, arch, uid, pid, etc.)

-S syscall

Specify a syscall name or number to audit (use with -a)

-k key

Set a filter key on an audit rule for easier log searching

-p permissions

Permissions filter (r=read, w=write, x=execute, a=attribute change)

-R file

Read and execute auditctl commands from a file

CONFIGURATION

/etc/audit/audit.rules

Persistent audit rules loaded at boot by auditd. Rules added with auditctl are lost on reboot unless saved here.

INSTALL

sudo apt install auditd

sudo dnf install audit

sudo pacman -S audit

sudo apk add audit

sudo zypper install audit

nix profile install nixpkgs#audit

CAVEATS

Requires root privileges. Rules added with auditctl are not persistent across reboots; use /etc/audit/audit.rules for persistence. Excessive auditing can impact system performance.

HISTORY

auditctl is part of the audit package, providing the Linux Audit Framework for security monitoring and compliance.