auditctl

Install

# RHEL / Alma / Rocky
sudo dnf install audit

# Debian / Ubuntu
sudo apt install auditd

# openSUSE
sudo zypper install audit

# Arch
sudo pacman -S audit

What it does

auditctl manages audit rules in the Linux kernel. It allows administrators to define what system calls, files, or events should be logged by the audit subsystem.

How it works (mechanical)

• Communicates with the kernel audit subsystem.
• Adds or removes rules stored in kernel memory.
• Controls runtime auditing behavior.
• Rules are lost on reboot unless saved in persistent configuration files.

Quick Start

# List current audit rules
sudo auditctl -l

10 Practical Examples

# 1) List active rules
sudo auditctl -l

# 2) Add watch on file
sudo auditctl -w /etc/passwd -p wa -k passwd_changes

# 3) Remove watch
sudo auditctl -W /etc/passwd

# 4) Add syscall rule (64-bit example)
sudo auditctl -a always,exit -F arch=b64 -S execve -k exec_log

# 5) Monitor specific user ID
sudo auditctl -a always,exit -F uid=1000 -S open -k user_open

# 6) Clear all rules
sudo auditctl -D

# 7) Check audit status
sudo auditctl -s

# 8) Set audit backlog limit
sudo auditctl -b 8192

# 9) Enable failure mode (panic on audit failure)
sudo auditctl -f 2

# 10) Combine rule filters
sudo auditctl -a always,exit -F arch=b64 -S open -F success=0 -k failed_open

Notes & Gotchas

• Requires auditd service running.
• Rules added with auditctl are temporary and reset on reboot.
• Persistent rules should be placed in /etc/audit/rules.d/.
• Overly broad rules can generate large volumes of log data.
• Use keys (-k) to label rules for easier searching with ausearch.

Related Commands

• ausearch - search audit logs.
• aureport - summarized audit reports.
• semanage - manage SELinux policy settings.
• getenforce - check SELinux mode.
• journalctl - view system logs.