/PLAYBOOK · 2026-08-04

auditd Hands-On: Linux System Audit and Attribution

Configure Linux auditd rules, search logs, and lock down tamper resistance. Monitor critical files, attribute privileged commands and SSH logins, and keep a full evidence chain for compliance and forensics.

Scope

auditd fits high-security cases that must record who did what to which file or command, and when: MLPS Level 3 compliance, integrity watches on critical files (/etc/passwd, Web dirs), privileged-command and SSH login attribution, post-breach forensics. It uses the Linux kernel audit subsystem. No third-party agent.

Prerequisites

Linux kernel 2.6+ (audit built in by default)

root

At least 1GB disk (default log dir /var/log/audit/)

Mechanism

auditd rides the kernel audit subsystem. The kernel queues syscalls, file access, and login events; userspace auditd writes them to disk; auditctl loads rules. Search with ausearch (filtered) and aureport (summaries). Persistent rules live in /etc/audit/rules.d/.

Steps

Step 1: Install and start

Ubuntu/Debian:

`sudo apt install -y auditd audispd-plugins
sudo systemctl enable --now auditd`

CentOS/RHEL is usually already present:

`sudo systemctl enable --now auditd`

Step 2: Write audit rules

Create /etc/audit/rules.d/security.rules:

`# Monitor writes and attribute changes on critical files
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
# Monitor Web directory file changes
-w /var/www/html -p wa -k webroot
# Record all commands executed by root
-a always,exit -F arch=b64 -S execve -F euid=0 -k rootcmd
# Record network connection establishment
-a always,exit -F arch=b64 -S connect -k network`

-w watches a path, -p wa means write and attribute change, -k sets the search key.

Step 3: Load rules

`sudo auditctl -R /etc/audit/rules.d/security.rules
sudo auditctl -l`

Step 4: Query and attribute

`# Search today's events by key
sudo ausearch -k identity -ts today
# Human-readable output (uid to username)
sudo ausearch -k webroot -i
# Authentication and login report
sudo aureport -au
sudo aureport -l`

-i maps numeric IDs to names. -ts today limits the time window.

Step 5: Log protection and tamper resistance

Edit /etc/audit/auditd.conf:

`max_log_file = 128
num_logs = 5
space_left = 75
action_mail_acct = root`

After rules load, set immutable mode (rules cannot change until reboot):

`echo "-e 2" | sudo tee -a /etc/audit/rules.d/security.rules
sudo auditctl -R /etc/audit/rules.d/security.rules`

Verification

Trigger: run `sudo touch /etc/passwd`, then `sudo ausearch -k identity -i`. Expect a type=PATH record

Rules active: `sudo auditctl -l` matches the rule file

Reports work: `sudo aureport -au` shows authentication attempt stats

Persist across reboot: after reboot, recheck `sudo auditctl -l`; rules still present

FAQ

Q1: Does auditd conflict with an ELK stack?

No. auditd collects at kernel level. Ship events into ELK via audispd plugins (e.g. syslog forwarding) for unified analysis and real-time alerts.

Q2: Web directory watches flood the logs. Now what?

Narrow the watch to critical subdirs. Use `-k` keys for precise search. If still too large, raise max_log_file and enable rotation (num_logs).

Q3: Rules gone after reboot?

Rules added with `auditctl` last only for the current session. Write them to /etc/audit/rules.d/ so they load automatically after reboot.

Takeaway

auditd supplies a lower-level evidence chain than Web logs: files, commands, and network connects are fully attributable. Enable it on critical servers. Pair keyed rules with periodic ausearch reviews as the forensic base for incident response and compliance.