auditd Basics

Introduction¶

The Linux audit subsystem (auditd) logs kernel-level events: file access, syscalls, authentication, privilege changes. It's how you answer "who deleted /etc/shadow entry X at 3am" and it's required for many compliance regimes (PCI, CIS, STIG).

Architecture¶

• The kernel generates audit events based on rules.
• auditd writes them to /var/log/audit/audit.log.
• auditctl loads rules at runtime; /etc/audit/rules.d/*.rules → compiled to /etc/audit/audit.rules by augenrules on service start.
• ausearch / aureport query the log; aureport summarises.

Rule types¶

Control¶

-D                      # delete all rules (start fresh)
-b 8192                 # kernel backlog buffer
-f 1                    # failure mode: 0=silent 1=printk 2=panic
--backlog_wait_time 60000

File watches (-w)¶

Watch a path for permission/attribute/write/execute:

-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope
-w /etc/ssh/sshd_config -p wa -k sshd
-w /var/log/audit/ -p wa -k auditlog
-w /usr/bin/ -p x -k binexec        # noisy — example only

-p: r read, w write, x execute, a attribute change. -k is a key — a searchable label. Name keys consistently (CIS/STIG use standard names like identity, perm_mod, access).

Syscall rules (-a)¶

# Log privilege escalation attempts
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=unset -k privileged

# Log changes to system time
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k time-change

# Log deletion of files by users
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=unset -k delete

# Log mounts
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k mounts

# Make the config immutable until reboot (put LAST)
-e 2

arch=b64 and b32 — add both on a system that runs 32-bit binaries, or a 32-bit syscall slips past a b64-only rule.

auid (audit/login UID) is the original login user even after sudo — that's what makes auditd useful for accountability. auid!=unset (older: auid!=4294967295) excludes daemons with no login session.

Searching¶

ausearch -k identity --start today
ausearch -k delete -ui alice -i          # -i interpret ids/syscalls to names
ausearch -m USER_LOGIN --start recent
ausearch -f /etc/sudoers -i

aureport --summary
aureport -au --failed                    # failed authentications
aureport -f -i --start this-week         # file report
aureport -x --summary                    # executables

-i (interpret) turns UIDs, syscall numbers, and timestamps into readable names — always use it.

Performance¶

Auditd overhead is real for hot paths:

• -w /usr/bin/ -p x logs every command execution — huge volume. Scope to specific binaries.
• Syscall rules on open/openat without tight filters can log millions of events. Filter by auid, dir=, path=, exe=.
• -a always,exclude -F msgtype=CWD and similar to trim noise.
• Ship logs off-box (audisp-remote / a syslog plugin) so the local disk isn't the constraint, and set max_log_file / num_logs / space_left_action in auditd.conf.

Verification and troubleshooting¶

auditctl -s                     # status: enabled, backlog, lost events
auditctl -l                     # loaded rules
augenrules --check              # do rules.d and audit.rules match?
systemctl status auditd

• auditctl -s shows lost > 0 — backlog too small (-b), or the disk/ consumer can't keep up. Raise -b, reduce rule volume, ship remotely.
• Rules not loading on boot — a syntax error in one rules.d file aborts augenrules; augenrules --check and journalctl -u auditd.
• Can't change rules: "rule exists" / immutable — -e 2 was set. Reboot to modify, or don't set -e 2 in dev.
• ausearch finds nothing for an action you know happened — no rule covered that syscall/path, the arch filter missed a 32-bit call, or auid filter excluded it (a system service, not a login user).
• Log volume exploding — a broad -p x or open rule. aureport --summary and aureport -k to see which key dominates; tighten that rule.
• auditd vs SELinux/AppArmor denials — AVC denials also land in the audit log (ausearch -m AVC); useful, don't confuse them with your rules.
• SYSCALL events with no matching PATH/CWD — normal; related records share an event id, ausearch groups them, raw log doesn't.

Related tools and reading¶

• On-site: Linux commands reference, Timestamp converter.
• Related posts: SELinux without setenforce 0, sudoers done safely.