Red Hat Security: Linux in Physical, Virtual, and Cloud

The Linux Audit system collects and logs security-related events based on a list of Audit rules. Audit is managed by the kernel.

The kernel sends the Audit messages that it collects to a user-space daemon (auditd), which is responsible for recording them.

The auditd daemon can save messages to a local log, or relay them to a remote auditd or syslog service.

You can use the ausearch and aureport commands to analyze the Audit log.

You can define Audit rules persistently by editing files in the /etc/audit/rules.d/ directory that have a .rules suffix.

There are three types of rules: file system rules (watch rules), system call rules, and control rules.

The auditctl command might be used to edit Audit rules temporarily.

The audit package includes some sample Audit rule files to help you implement common security requirements.

If a control rule has been set to make the Audit rules immutable, then the Audit rules cannot be changed until the system is rebooted.