System auditing is essential for monitoring user activity, detecting unauthorized access, and ensuring compliance with security standards. On Linux, the Audit Daemon (auditd) provides powerful auditing capabilities for logging system events and actions.
This short article will walk you through installing, configuring, and using auditd to monitor your Linux system.
What is auditd?
auditd is the user-space component of the Linux Auditing System. It logs system calls, file access, user activity, and more — offering administrators a clear trail of what’s happening on the system.
1. Installing auditd
The auditd package is available by default in most major Linux distributions.
On Debian/Ubuntu
# apt update
# apt install auditd audispd-plugins
On CentOS/RHEL/Fedora
# yum install audit
After installation, start and enable the audit daemon
# systemctl start auditd
# systemctl enable auditd
Check its status
# systemctl status auditd
2. Setting Audit Rules
Once auditd is running, you need to define rules that tell it what to monitor.
Example: Monitor changes to /etc/passwd
# auditctl -w /etc/passwd -p rwxa -k passwd_monitor
Explanation:
-
-w /etc/passwd: Watch this file. When the file is accessed, the watcher will generate events.
-
-p rwxa: Monitor read, write, execute, and attribute changes
-
-k passwd_monitor: Assign a custom key name to identify logs. Later on, we could search for this (arbitrary) passwd string to identify events tagged with this key.
List active rules:
# auditctl -l
3. Common auditd Rules for Security Monitoring
Here are some common and useful auditd rules you can use to monitor system activity and enhance Linux system security. These rules are typically added to the /etc/audit/rules.d/audit.rules or /etc/audit/audit.rules file, depending on your system.
a. Monitor Access to /etc/passwd and /etc/shadow
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-
Monitors read/write/attribute changes to password files.
b. Monitor sudoers file and directory
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-
Tracks any change to sudo configuration files.
c. Monitor Use of chmod, chown, and passwd
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -k perm_mod
-a always,exit -F arch=b64 -S passwd -k passwd_changes
-
Watches permission and ownership changes.
d. Monitor User and Group Modifications
-w /etc/group -p wa -k group_mod
-w /etc/gshadow -p wa -k gshadow_mod
-w /etc/security/opasswd -p wa -k opasswd_mod
-
Catches user/group-related config changes.
e. Track Logins, Logouts, and Session Initiation
-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock/ -p wa -k failed_login
-w /var/log/faillog -p wa -k faillog
-
Tracks login attempts and failures.
f. Monitor auditd Configuration Changes
-w /etc/audit/ -p wa -k auditconfig
-w /etc/audit/audit.rules -p wa -k auditrules
-
Watches changes to auditd configuration and rules.
g. Detect Changes to System Binaries
-w /bin/ -p wa -k bin_changes
-w /sbin/ -p wa -k sbin_changes
-w /usr/bin/ -p wa -k usr_bin_changes
-w /usr/sbin/ -p wa -k usr_sbin_changes
-
Ensures core binaries aren't tampered with.
h. Track Kernel Module Loading and Unloading
-a always,exit -F arch=b64 -S init_module -S delete_module -k kernel_mod
-
Detects dynamic kernel-level changes.
l. Monitor File Deletions
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -k delete
-
Tracks when files are removed or renamed.
m. Track Privilege Escalation via setuid/setgid
-a always,exit -F arch=b64 -S setuid -S setgid -k priv_esc
-
Helps detect changes in user or group privileges.
n. Track Usage of Dangerous Binaries (e.g., su, sudo, netcat)
-w /usr/bin/su -p x -k su_usage
-w /usr/bin/sudo -p x -k sudo_usage
-w /bin/nc -p x -k netcat_usage
-
Useful for catching potentially malicious command usage.
o. Monitor Cron Jobs
-w /etc/cron.allow -p wa -k cron_allow
-w /etc/cron.deny -p wa -k cron_deny
-w /etc/cron.d/ -p wa -k cron_d
-w /etc/crontab -p wa -k crontab
-w /var/spool/cron/ -p wa -k user_crontabs
-
Alerts on cron job creation/modification.
p. Track Changes to /etc/hosts and DNS Settings
-w /etc/hosts -p wa -k etc_hosts
-w /etc/resolv.conf -p wa -k resolv_conf
-
Monitors potential redirection or DNS manipulation.
q. Monitor Mounting and Unmounting of Filesystems
-a always,exit -F arch=b64 -S mount -S umount2 -k mounts
-
Useful for detecting USB or external drive activity.
r. Track Execution of New Programs
-a always,exit -F arch=b64 -S execve -k exec
-
Captures command execution (can generate a lot of logs).
A complete list of rules you can get from the hardening.rules auditd file place it under /etc/audit/rules.d/hardening.rules
and reload auditd to load the configurations.
Tips
-
Use ausearch -k <key> to search audit logs for matching rule.
-
Use auditctl -l to list active rules.
-
Use augenrules –load after editing rules in /etc/audit/rules.d/.
4. Reading Audit Logs
Audit logs events are stored in:
/var/log/audit/audit.log
By default, the location, this can be changed through /etc/auditd/auditd.conf
View recent entries:
# tail -f /var/log/audit/audit.log
Search by key:
# ausearch -k passwd_monitor
Generate a summary report:
# aureport -f
# aureport
Example: Show all user logins / IPs :
# aureport -au
5. Making Audit Rules Persistent
Rules added with auditctl are not persistent and will be lost on reboot. To make them permanent:
Edit the audit rules configuration:
# vim /etc/audit/rules.d/audit.rules
Add your rules, for example:
-w /etc/passwd -p rwxa -k passwd_monitor
Apply the rules:
# augenrules –load
7. Some use case examples of auditd in auditing Linux servers by sysadmins / security experts
Below are real-world, practical examples where auditd is actively used by sysadmins, security teams, or compliance officers to detect suspicious activity, meet compliance requirements, or conduct forensic investigations.
a. Detect Unauthorized Access to /etc/shadow
Use Case: Someone tries to read or modify password hashes.
Audit Rule:
-w /etc/shadow -p wa -k shadow_watch
Real-World Trigger:
sudo cat /etc/shadow
Check Logs:
# ausearch -k shadow_watch -i
Real Output:
type=SYSCALL msg=audit(09/18/2025 14:02:45.123:1078):
syscall=openat
exe="/usr/bin/cat"
success=yes
path="/etc/shadow"
key="shadow_watch"
b. Detect Use of chmod to Make Files Executable
Use Case: Attacker tries to make a script executable (e.g., malware).
Audit Rule:
-a always,exit -F arch=b64 -S chmod -k chmod_detect
Real-World Trigger:
# chmod +x /tmp/evil_script.sh
Check Logs:
# ausearch -k chmod_detect -i
c. Monitor Execution of nc (Netcat)
Use Case: Netcat is often used for reverse shells or unauthorized network comms.
Audit Rule:
-w /bin/nc -p x -k netcat_usage
Real-World Trigger:
nc -lvp 4444
Log Entry:
type=EXECVE msg=audit(09/18/2025 14:35:45.456:1123):
argc=3 a0="nc" a1="-lvp" a2="4444"
key="netcat_usage"
d. Alert on Kernel Module Insertion
Use Case: Attacker loads rootkit or malicious kernel module.
Audit Rule:
-a always,exit -F arch=b64 -S init_module -S delete_module -k kernel_mod
Real-World Trigger:
# insmod myrootkit.ko
Audit Log:
type=SYSCALL msg=audit(09/18/2025 15:00:13.100:1155):
syscall=init_module
exe="/sbin/insmod"
key="kernel_mod"
e. Watch for Unexpected sudo Usage
Use Case: Unusual use of sudo might indicate privilege escalation.
Audit Rule:
-w /usr/bin/sudo -p x -k sudo_watch
Real-World Trigger:
sudo whoami
View Log:
# ausearch -k sudo_watch -i
f. Monitor Cron Job Modification
Use Case: Attacker schedules persistence via cron.
Audit Rule:
-w /etc/crontab -p wa -k cron_mod
Real-World Trigger:
echo "@reboot /tmp/backdoor" >> /etc/crontab
Logs:
type=SYSCALL msg=audit(09/18/2025 15:05:45.789:1188):
syscall=open
path="/etc/crontab"
key="cron_mod"
g. Detect File Deletion or Renaming
Use Case: Attacker removes logs or evidence.
Audit Rule:
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -k file_delete
Real-World Trigger:
# rm -f /var/log/syslog
Logs:
type=SYSCALL msg=audit(09/18/2025 15:10:33.987:1210):
syscall=unlink
path="/var/log/syslog"
key="file_delete"
h. Detect Script or Malware Execution
Use Case: Capture any executed command.
Audit Rule:
-a always,exit -F arch=b64 -S execve -k exec
Real-World Trigger:
/tmp/myscript.sh
Log View:
# ausearch -k exec -i | grep /tmp/myscript.sh
l. Detect Manual Changes to /etc/hosts
Use Case: DNS hijacking or phishing setup.
Audit Rule:
-w /etc/hosts -p wa -k etc_hosts
Real-World Trigger:
# echo "1.2.3.4 google.com" >> /etc/hosts
Logs:
type=SYSCALL msg=audit(09/18/2025 15:20:11.444:1234):
path="/etc/hosts"
syscall=open
key="etc_hosts"
8. Enable Immutable Mode (if necessery)
For enhanced security, you can make audit rules immutable, preventing any changes until reboot:
# auditctl -e 2
To make this setting persistent, add the following to the end of /etc/audit/rules.d/audit.rules:
-e 2
Common Use Cases
Here are a few more examples of what you can monitor:
Monitor all sudo usage:
# auditctl -w /var/log/auth.log -p wa -k sudo_monitor
Monitor a directory for file access:
# auditctl -w /home/username/important_dir -p rwxa -k dir_watch
Audit execution of a specific command (e.g., rm):
# auditctl -a always,exit -F arch=b64 -S unlink,unlinkat -k delete_cmd
(Adjust arch=b64 to arch=b32 if on 32-bit system.)
9. Managing the Audit Log Size
Audit logs can grow large over time. To manage log rotation and size, edit:
# vim /etc/audit/auditd.conf
Set log rotation options like:
max_log_file = 8
num_logs = 5
Then restart auditd:
# systemctl restart auditd
Conclusion
The Linux Audit Daemon (auditd) is a powerful tool to track system activity, enhance security, and meet compliance requirements. With just a few configuration steps, you can monitor critical files, user actions, and system behavior in real time.
References
-
man auditd
-
man auditctl
-
Linux Audit Wiki
