AUDITFILTERD(8)

💖 auditfilterd(8) — audit filter daemon 💖

okay so bestie, welcome to the System Manager's Manual page for auditfilterd, the audit filter daemon. she's iconic, she's experimental, and she has opinions. let's get into it 💅

---

🎀 NAME 🎀

auditfilterd — audit filter daemon. periodt.

---

✨ SYNOPSIS ✨

auditfilterd [-d] [-c conffile] [-p pipefile] [-t trailfile]

---

🦋 DESCRIPTION 🦋

okay so the auditfilterd daemon is an extensible audit event monitoring daemon, and the whole vibe is that it lets pluggable modules track audit events from a live audit source. she is configured using the audit_filter configuration file. the source can either be a pipe or a file. literally either one, bestie 🫶

the options are as follows:

• -c conffile — specify an alternative configuration file. yes, you can give her a different conffile. slay.
• -d — starts the daemon in debug mode — it will not daemonize. she stays right there with you. no cap.
• -p pipefile — specify a pipe as an alternative source of audit event records. the default is /dev/auditpipe. iykyk.
• -t trailfile — specify a file as an alternative source of audit event records. trailfile said let me be the source. iconic.

---

💜 FILES 💜

• /etc/security/audit_filterd — default configuration file for auditfilterd. that's her home base 💖
• /dev/auditpipe — default audit record source for auditfilterd. the default pipe bestie 🎀

---

🌈 SEE ALSO 🌈

audit(8), auditd(8)

go read those too, bestie. the more you know ✨

---

🌸 HISTORY 🌸

the OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in 2004. it was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. okay history lesson over, but like… lowkey important 🫶

---

👑 AUTHORS 👑

the auditfilterd daemon and audit filter APIs were created by Robert Watson. thank you robert, we appreciate you 💖

---

💀 BUGS 💀

auditfilterd is experimental, and should not be relied on in production. APIs and services it offers can and will change in future OpenBSM releases. so like, don't put your whole production life on her yet, bestie. she's still growing 🌱

---

okay that's the whole page. every flag, every path, every warning. no skipped details, no invented lore. we ate and left no crumbs 💅

---

Debian · October 3, 2006 · mwah 💋 bye bestie 🦋