Linux Audit System

auditd, auditctl rules, ausearch, aureport, and using audit logs for forensic investigation.

Overview

The Linux Audit System is a kernel-level event logging framework that records security-relevant events with high fidelity — far beyond what traditional application logs capture. Every syscall, file access, user authentication event, and privilege escalation can be recorded with full context: who did it (UID, PID, process name), what they did, and when.

Architecture

The audit system has two layers:

Kernel audit subsystem — intercepts system calls and file accesses according to rules. Events are written to an in-kernel ring buffer.

auditd daemon — reads from the kernel ring buffer and writes events to /var/log/audit/audit.log (default) or forwards to a remote audit server via audisp.

Audit Rules

Rules are loaded with auditctl or persistently via files in /etc/audit/rules.d/:

File watch (-w): generates events when a file or directory is accessed in the specified way:

Syscall audit (-a): generates events when a specific syscall is called:

Log Format

Audit events are structured records with key=value pairs:

Key concepts

auditd: Audit daemon that reads events from the kernel ring buffer and writes them to /var/log/audit/audit.log. Must be running for audit events to be persisted. Config at /etc/audit/auditd.conf.
auditctl: Command to load audit rules at runtime. Rules are lost on reboot unless saved to /etc/audit/rules.d/*.rules. auditctl -l lists active rules. auditctl -D deletes all rules.
ausearch: Search audit logs by key, user, time, or event type. ausearch -k passwd-changes -ts today finds all events for the "passwd-changes" key since midnight. Output is human-readable audit records.
aureport: Summary reports from audit logs. aureport --summary gives an overview. aureport --login shows all login events. aureport --exe shows executed commands. Useful for trend analysis.
-k key: A tag applied to audit rules for easy searching. -k sudo-commands marks all events from that rule with the key "sudo-commands". Retrieve with ausearch -k sudo-commands.
/etc/audit/rules.d/: Persistent audit rules loaded at auditd startup. Files end in .rules. augenrules --check validates rule syntax. RHEL ships 30-stig.rules for STIG compliance.

When to use it

Post-incident forensics — who deleted this critical file? ausearch -k file-deletion -ts 2024-01-15
Compliance requirements (PCI-DSS, SOC 2, HIPAA) requiring audit trails for privileged command execution
Detecting unauthorized changes to sensitive files like /etc/passwd, /etc/sudoers, /etc/ssh/sshd_config
Tracking sudo usage across a fleet — aureport --summary shows privilege escalation frequency
Monitoring a specific user account during an incident investigation — auditctl -F uid=1000

Interview questions

A critical file /etc/sudoers was modified. How do you use auditd to find out who did it and when?
How do you set up persistent audit rules that survive reboots?