auditd

auditd [-f] [-l] [-n] [-s disable|enable|nochange] [-c configdir_]

auditd is the Linux Audit daemon that collects audit events from the kernel and writes them to disk. It's part of the Linux Audit framework for tracking security-relevant events.The daemon logs file accesses, system calls, authentication events, and other activities based on configured rules.

-f

Leave the daemon in the foreground for debugging. Messages also go to stderr rather than the audit log.

Allow the daemon to follow symbolic links for config files.

Do not fork. Useful for running from inittab or systemd.

Set the kernel audit enabled flag state at startup. The default enables the flag on start and disables it on termination. The flag can also be changed at runtime with auditctl.

Use an alternate config directory. The same directory is also passed to the dispatcher (default: /etc/audit/).

/etc/audit/auditd.conf

Main daemon configuration controlling log file location, retention, disk space handling, and dispatcher settings.

Directory containing audit rule files compiled by augenrules into the active ruleset. Rules define which system calls and file accesses to monitor.

Directory of plugin (dispatcher) configuration files for routing events to external programs.

Requires root privileges. Heavy auditing can impact performance, and log files grow quickly with verbose rules. On modern systems the daemon should be started, stopped, and reloaded through its service manager (for example systemctl or service auditd rotate) rather than by sending signals directly.

auditd was developed as part of the Linux Audit project to meet Common Criteria security requirements, becoming part of the mainline kernel in 2.6.6 (2004).

auditctl(8), ausearch(8), aureport(8)

Source code