Auditd
Definition
The Linux Audit Daemon. Writes /var/log/audit/audit.log based on rules configured in /etc/audit/audit.rules. Read with ausearch and aureport.
- Log file
- /var/log/audit/audit.log
- Rule file
- /etc/audit/audit.rules
- Query tools
- ausearch, aureport
- Runs on
- Linux kernel audit subsystem
Common questions
Does auditd run by default on every Linux system?+
No. It ships with most enterprise distributions but is not always installed or enabled on minimal or desktop builds, so an examiner should confirm its presence and active rule set rather than assume logging occurred.
What does auditd log if no watch rules are configured in audit.rules?+
The daemon still runs and captures some kernel-level events by default, but without explicit watch or syscall rules the log is far sparser than an examiner might expect, so rule configuration should always be checked.
Related terms
- Inode
- The ext2/3/4 metadata structure that holds a file's permissions, ownership, MAC times, link count and block pointers. The file name lives in...
- Journalctl
- The query interface to systemd-journald, the binary structured-logging daemon that backs modern Linux distributions. Binary database under /var/log/journal/.
- Plaso / Log2timeline
- The cross-artifact super-timeline tool. log2timeline.py extracts events from many sources into a .plaso storage file; psort.py renders the timeline to CSV or...
- SUID / SGID
- Set-User-ID and Set-Group-ID permission bits. A SUID binary runs with the owner's privileges regardless of the invoking user. A common persistence and...
- Wtmp / Utmp / Btmp
- Binary login databases under /var/log and /var/run. wtmp logs successful logins, utmp reflects current sessions, btmp logs failed login attempts. Read with...