Master Linux auditd: Install, Configure, and Analyze Auditing Rules

What is auditd?

auditd (the audit daemon) is a user‑space component of the Linux Auditing System that writes audit records to disk.

Installing auditd

On Ubuntu you can install auditd using apt‑get or the wajig tool.

auditctl: controls the daemon in real time, e.g., adding rules.

/etc/audit/audit.rules: file that stores audit rules.

aureport: generates audit reports.

ausearch: searches audit events.

auditspd: forwards events to other applications.

autrace: tracks processes.

/etc/audit/auditd.conf: configuration file for auditd.

After the first installation the audit rule set is empty.

Viewing current rules

$ sudo auditctl -l

How to use auditd

File and directory access auditing

To monitor changes to files or directories, use auditctl with root privileges.

File auditing example

$ sudo auditctl -w /etc/passwd -p rwxa

Options:

-w path: specifies the path to monitor (e.g., /etc/passwd).

-p: sets the permissions that trigger an audit.

rwxa: r = read, w = write, x = execute, a = attribute change.

Directory auditing example

$ sudo auditctl -w /production/

This monitors all accesses to the /production directory.

Run auditctl -l to list all configured rules.

Viewing audit logs

After adding rules, use ausearch to query the logs. For example, to view events for /etc/passwd: $ sudo ausearch -f /etc/passwd The output includes fields such as time, name, cwd, syscall, auid, uid/gid, comm, and exe, which describe when and how the file was accessed.

Generating audit reports

The aureport tool creates summary reports from the audit log. $ sudo aureport Running aureport -au shows detailed authentication failures, and aureport -m lists all modification events.

Persisting audit rules

Add your rules to /etc/audit/audit.rules to make them permanent, then restart the auditd service: # /etc/init.d/auditd restart or

# service auditd restart

Conclusion

auditd is a powerful Linux auditing tool. Consult the manual pages ( man auditd, man ausearch) for detailed options, and create rules carefully to avoid excessive log growth.