Getting started with auditd: watch files and commands on Linux

What auditd records

The Linux audit system logs kernel-level events according to rules: file reads and writes, system calls, and process executions. Unlike application logs, it records who did something even when the program itself logs nothing. Events go to /var/log/audit/audit.log.

Rules are either file watches (-w path -p permissions) or syscall rules (-a always,exit -S syscall). A key (-k) tags matching events so you can search for them later.

A small, useful rule set

Watch identity files for writes and attribute changes, sudoers for changes, SSH configuration for changes, and log every command executed by root or by an interactive user. Put rules in /etc/audit/rules.d/ and load them with augenrules --load.

Start small. Logging every syscall floods the disk and the analyst. A focused set that answers specific questions is more valuable.

Snippet

# /etc/audit/rules.d/50-lab.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd
-a always,exit -F arch=b64 -S execve -F euid=0 -k root_cmds

sudo augenrules --load
sudo auditctl -l

Lab: catch a change and a command

After loading the rules, add a user with useradd, edit sshd_config, and run a command as root with sudo. Search for each with ausearch -k and the key. The output shows the user’s original login ID (auid), so you can tell which person was behind sudo even though the action ran as root.

aureport gives summaries: aureport -x for executables, aureport -au for authentication, aureport -k for key hits.

Snippet

sudo useradd demo1
sudo ausearch -k identity -i | tail -30
sudo ausearch -k root_cmds -i --start recent | grep -E "auid=|exe=" | head
sudo aureport -k --summary

Keep it sustainable

Check volume with ls -lh /var/log/audit/ after a day. Tune noisy rules by adding filters such as -F auid>=1000 -F auid!=unset for human users only. Forward audit logs to your central platform so a root user on the host cannot quietly delete them.

Make the configuration immutable with -e 2 as the last rule on high-security systems. Rules then cannot change until reboot, which stops an intruder from disabling auditing silently.

Diagram

From rule to answer

Write
Add -w watches and -a syscall rules with keys.
Load
Apply with augenrules --load and confirm with auditctl -l.
Command
```
sudo augenrules --load && sudo auditctl -l
```
Search
Query by key with ausearch -k -i.
Tune
Filter noise, forward logs, consider -e 2.

Check yourself

1. Which rule watches /etc/shadow for writes and attribute changes?

2. Which field identifies the person who logged in, even after sudo?

3. What does -e 2 do?