Red Hat Security: Linux in Physical, Virtual, and Cloud

Linux Audit is a system managed by the kernel to collect and log security-related events based on a list of audit rules.

The kernel sends the audit messages it collects to a user-space daemon, auditd, which is responsible for recording them.

auditd can save messages to a local log or relay them to a remote auditd or syslog service.

You can use the ausearch and aureport commands to analyze the audit log.

You can define audit rules persistently by editing files in /etc/audit/rules.d that have a .rules suffix.

There are three types of rules: file system rules (watches), system call rules, and control rules.

The auditctl command may be used to edit Audit rules temporarily.

The audit package includes some prepackaged Audit rule files that can be used to help implement common security requirements.

If a control rule has been set to make the audit rules immutable, they cannot be changed until the system is rebooted.