What it does
The kernel audit system, with the auditd daemon, writes detailed records to /var/log/audit/audit.log: file access (watches), system calls, logins, sudo, SELinux denials. auditctl adds and lists rules at runtime; permanent rules go in /etc/audit/rules.d/*.rules and are loaded by augenrules. ausearch and aureport read the log.
Audit rules are required by CIS, STIG and PCI-DSS (for example: log changes to /etc/passwd, /etc/sudoers and time settings).
How to write it
auditctl -w PATH -p rwxa -k KEY
auditctl -a always,exit -F arch=b64 -S SYSCALL [-F ...] -k KEY
auditctl -l | -s | -DMain parts
Commands
-l- List the loaded rules.
-s- Status (enabled, lost events, backlog).
-wPATH-pPERMS-kKEY- Watch a file or folder.
-WPATH- Remove a watch.
-aalways,exit-SCALL- Add a syscall rule.
-D- Delete all rules.
-e0|1|2- Disable / enable / lock (2 = no changes until reboot).
Options 6
Most used
Rule parts
Nothing matches this filter.
Examples 10
$ run as a normal user# run as root (or with sudo)
1Status and rules
auditctl -s auditctl -l2Watch identity files
auditctl -w /etc/passwd -p wa -k identity auditctl -w /etc/shadow -p wa -k identity auditctl -w /etc/sudoers -p wa -k sudoers auditctl -w /etc/sudoers.d/ -p wa -k sudoers3Make the rules permanent
cat /etc/audit/rules.d/50-identity.rules -w /etc/passwd -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/sudoers -p wa -k sudoers -w /etc/ssh/sshd_config -p wa -k sshd augenrules --load4Log every command run by real users
cat /etc/audit/rules.d/60-exec.rules -a always,exit -F arch=b64 -S execve -F auid>=1000 -F auid!=unset -k user_cmds -a always,exit -F arch=b32 -S execve -F auid>=1000 -F auid!=unset -k user_cmds5Log failed file access (permission denied)
auditctl -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -k access_denied6Search by key
7Reports
aureport --summary aureport -au --failed aureport -x --summary | head8Lock the rules (production)
cat /etc/audit/rules.d/99-finalize.rules -e 2 augenrules --load9Use the CIS / STIG sample rules
10Restart auditd the right way
service auditd restartsystemctl restart auditdis refused; auditd must be restarted withservice.
Nothing matches this filter.
Watch out
- Too many syscall rules slow the system and fill the disk; set log rotation in
/etc/audit/auditd.conf. - With
-e 2you cannot change rules until reboot (good for production, bad while testing). - Send audit logs to a central system; a root attacker can delete local logs.
Files
/etc/audit/rules.d/*.rules- Permanent rules.
/etc/audit/audit.rules- Generated by augenrules (do not edit).
/etc/audit/auditd.conf- Daemon settings (size, rotation, disk-full action).
/var/log/audit/audit.log- The log.
Tips to remember
- Always use
-kkeys; they makeausearchfast and clear.
Exit codes
0 | Success. |
1 | Error. |