AUDITD(8)

📦
version 4.2.1 · 6 versions
, in alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, nixpkgs unstable, ubuntu resolute, ubuntu stonking

💖 AUDITD — the Linux Audit daemon 💖

okay bestie, so this is the manual page for auditd, from the System Administration Utilities fam. Sit down, grab a strawberry 🍓, and let me tell you about the little daemon that writes down EVERYTHING.

✨ NAME ✨

auditd — The Linux Audit daemon 💅

🌸 SYNOPSIS 🌸

auditd [-f] [-l] [-n] [-s disable|enable|nochange] [-c <config_dir>]

look at her. short, sweet, absolutely slaying. ✨

🦋 DESCRIPTION 🦋

auditd is the userspace component to the Linux Auditing System, and honestly? she's the main character. Her whole job is writing audit records to the disk. That's it. That's the gig. 👑

Now, you don't read the logs with her — that's not her vibe. Viewing the logs is done with the ausearch or aureport utilities. And if you wanna configure the audit system or load rules? That's auditctl's moment, not hers.

Here's the tea on startup ☕: during startup, the rules in /etc/audit/audit.rules are read by auditctl and loaded into the kernel. But wait, there's more — alternately, there's also an augenrules program that reads rules located in /etc/audit/rules.d/ and compiles them into an audit.rules file. Iconic behaviour, no notes.

And the audit daemon herself? She has some configuration options that the admin may wish to customize. Where do they live? In the auditd.conf file. iykyk. 💖

💅 OPTIONS 💅

  • -f — leaves the audit daemon in the foreground for debugging. Also, messages go to stderr rather than the audit log. very "watch me work" energy 🔥
  • -l — allows the audit daemon to follow symlinks for config files. 🎀
  • -n — no fork. This is useful for running off of inittab or systemd. ngl she just doesn't feel like forking today 😌
  • -s=ENABLE_STATE — specifies when starting if auditd should change the current value for the kernel enabled flag. Valid values for ENABLE_STATE are "disable", "enable" or "nochange". The default is to enable (and disable when auditd terminates). Oh and btw, the value of the enabled flag may be changed during the lifetime of auditd using 'auditctl -e'. ✨
  • -c — specifies an alternate config file directory. Note that this same directory will be passed to the dispatcher. (default: /etc/audit/) 📁

🌈 SIGNALS 🌈

  • SIGHUP — causes auditd to reconfigure. This means that auditd re-reads the configuration file. If there are no syntax errors, it will proceed to implement the requested changes. If the reconfigure is successful, a DAEMON_CONFIG event is recorded in the logs. If not successful, error handling is controlled by space_left_action, admin_space_left_action, disk_full_action, and disk_error_action parameters in auditd.conf. so like... glow up or chaos, no in between 💀
  • SIGTERM — caused auditd to discontinue processing audit events, write a shutdown audit event, and exit. she said bye for real 🫶
  • SIGUSR1 — causes auditd to immediately rotate the logs. It will consult the max_log_file_action to see if it should keep the logs or not. fresh start energy ✨
  • SIGUSR2 — causes auditd to attempt to resume logging and passing events to plugins. This is usually needed after logging has been suspended or the internal queue is overflowed. Either of these conditions depends on the applicable configuration settings. 🧚
  • SIGCONT — causes auditd to dump a report of internal state to /run/audit/auditd.state. she's journaling, honestly 💜

🎀 EXIT CODES 🎀

  • 1 — Cannot adjust priority, daemonize, open audit netlink, write the pid file, start up plugins, resolve the machine name, set audit pid, or other initialization tasks. rough start, bestie 😭
  • 2 — Invalid or excessive command line arguments 🙈
  • 4 — The audit daemon doesn't have sufficient privilege. she's not allowed in, respectfully 💅
  • 6 — There is an error in the configuration file 📝

🍓 FILES 🍓

  • /etc/audit/auditd.conf — configuration file for audit daemon
  • /etc/audit/audit.rules — audit rules to be loaded at startup
  • /etc/audit/rules.d/ — directory holding individual sets of rules to be compiled into one file by augenrules.
  • /etc/audit/plugins.d/ — directory holding individual plugin configuration files.
  • /etc/audit/audit-stop.rules — These rules are loaded when the audit daemon stops.
  • /run/audit/auditd.state — report about internal state.

👑 NOTES 👑

A boot param of audit=1 should be added to ensure that all processes that run before the audit daemon starts is marked as auditable by the kernel. Not doing that will make a few processes impossible to properly audit. so like... do it. fr fr. ⚠️

The audit daemon can receive audit events from other audit daemons via the audisp-remote plugin. The audit daemon may be linked with tcp_wrappers to control which machines can connect. If this is the case, you can add an entry to hosts.allow and deny. networking but make it secure ✨

💜 SEE ALSO 💜

auditd.conf(5), auditd-plugins(5), ausearch(8), aureport(8), auditctl(8), augenrules(8), audit.rules(7).

go read those too, they're all part of the friend group 🫶

🌸 AUTHOR 🌸

Steve Grubb 💖

and that's the whole page, bestie!! brought to you by the fine people at Red Hat, version date Sept 2021 — AUDITD(8), System Administration Utilities. periodt. 💅✨

📦 where this page comes from