# auditd Cheatsheet - Cheatsheets - Launch Pad

__ _______________________ _________._________________________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

# auditd Cheatsheet

← Back to cheatsheets

← Home

auditd (Linux Audit Daemon) is the user-space component of the Linux Auditing System. It collects and stores audit records from the kernel, monitoring system calls and file access for security compliance and forensics.

## Service Management

- systemctl start auditd - Start audit daemon

- systemctl stop auditd - Stop audit daemon

- systemctl restart auditd - Restart audit daemon

- systemctl status auditd - Check audit daemon status

- systemctl enable auditd - Enable audit daemon at boot

- auditctl -e 1 - Enable auditing

- auditctl -e 0 - Disable auditing

- auditctl -s - Show audit system status

## Viewing Audit Logs

- ausearch -k <key> - Search by key

- ausearch -m <msg_type> - Search by message type

- ausearch -ua <uid> - Search by user ID

- ausearch -ui <uid> - Search by effective user ID

- ausearch -x <executable> - Search by executable name

- ausearch -sc <syscall> - Search by syscall

- ausearch -ts today - Search today's events

- ausearch -ts recent - Search recent events

- ausearch --start today --end now - Search time range

- aureport - Summary report of audit events

- aureport -au - Authentication report

- aureport -m - Account modifications report

- aureport -f - Failed file operations

- aureport --summary - Summary of all events

- ausearch -i - Interpret numeric entities (usernames, etc.)

- tail -f /var/log/audit/audit.log - Monitor audit log in real-time

## Configuring Rules

- /etc/audit/rules.d/audit.rules - Permanent rule configuration file

- /etc/audit/auditd.conf - Audit daemon configuration

- auditctl -l - List current rules

- auditctl -D - Delete all rules

- service auditd restart - Reload rules from configuration files

## File System Watch Rules

### Watching Files

- auditctl -w /etc/passwd -p rwxa -k passwd_changes - Watch file (read, write, execute, attribute)

- auditctl -w /etc/shadow -p wa -k shadow_changes - Watch file (write, attribute)

- auditctl -w /etc/sudoers -p wa -k sudoers_changes - Watch sudoers file

### Watching Directories

- auditctl -w /etc/ -p wa -k etc_changes - Watch directory

- auditctl -w /usr/bin/ -p x -k usr_bin_exec - Watch executable execution

- auditctl -w /var/log/ -p rwa -k log_access - Watch log directory

### Watch Permissions

- -p r - Read operations

- -p w - Write operations

- -p x - Execute operations

- -p a - Attribute changes (permissions, ownership)

## System Call Rules

### Basic Syntax

- auditctl -a always,exit -S <syscall> -F <field>=<value> -k <key> - Rule format

### Common System Calls

- auditctl -a always,exit -S chmod -F auid>=1000 -k file_permission_change

- auditctl -a always,exit -S chown -F auid>=1000 -k file_ownership_change

- auditctl -a always,exit -S unlink -F auid>=1000 -k file_deletion

- auditctl -a always,exit -S mount -k mount_operations

- auditctl -a always,exit -S setuid -k privilege_escalation

- auditctl -a always,exit -S setgid -k privilege_escalation

### Rule Actions

- always - Always generate audit record

- never - Never generate audit record

### Rule Lists

- task - Per-task list (applied on fork/clone)

- exit - Syscall exit list

- user - Per-user list

- exclude - Exclusion list

## Filter Fields

- -F auid=<uid> - Audit user ID

- -F uid=<uid> - User ID

- -F gid=<gid> - Group ID

- -F euid=<uid> - Effective user ID

- -F pid=<pid> - Process ID

- -F ppid=<pid> - Parent process ID

- -F arch=b64 - 64-bit architecture

- -F arch=b32 - 32-bit architecture

- -F exit=<value> - Exit value

- -F success!=0 - Failed operations only

- -F path=<file> - File path

- -F perm=<permissions> - File permissions (rwa)

## Useful Rule Examples

### Watch Critical System Files

    # /etc/passwd
    auditctl -w /etc/passwd -p wa -k passwd_changes

    # /etc/shadow
    auditctl -w /etc/shadow -p wa -k shadow_changes

    # /etc/sudoers
    auditctl -w /etc/sudoers -p wa -k sudoers_changes

    # /etc/hosts
    auditctl -w /etc/hosts -p wa -k hosts_changes

### Monitor Privilege Escalation

    # Monitor setuid/setgid
    auditctl -a always,exit -S setuid -S setgid -F auid>=1000 -k privilege_change

    # Monitor sudo usage
    auditctl -w /usr/bin/sudo -p x -k sudo_execution
    auditctl -w /usr/bin/su -p x -k su_execution

### Monitor Network Configuration

    # Network config files
    auditctl -w /etc/network/ -p wa -k network_changes

    # Firewall rules
    auditctl -w /etc/iptables/ -p wa -k firewall_changes

### Monitor User Management

    # User/group changes
    auditctl -a always,exit -S useradd -S usermod -S userdel -k user_management
    auditctl -a always,exit -S groupadd -S groupmod -S groupdel -k group_management

## Search Examples

### Search by Key

    ausearch -k passwd_changes -i

### Search Failed Logins

    ausearch -m LOGIN -sv no -i

### Search File Access

    ausearch -f /etc/shadow -i

### Search by User

    ausearch -ua 1000 -i

### Search Today's Events

    ausearch -ts today -i

## Configuration Files

### /etc/audit/auditd.conf

    # Log file location
    log_file = /var/log/audit/audit.log

    # Log format (RAW or NOLOG)
    log_format = RAW

    # Maximum log file size (MB)
    max_log_file = 8

    # Action when disk is full
    space_left_action = email
    action_mail_acct = root
    admin_space_left_action = suspend
    disk_full_action = suspend

    # Number of log files to keep
    num_logs = 5

### /etc/audit/rules.d/audit.rules

    # Delete all existing rules
    -D

    # Buffer settings
    -b 8192

    # Failure mode (0=silent, 1=printk, 2=panic)
    -f 1

    # Make rules immutable (cannot be changed until reboot)
    -e 2

    # Watch critical files
    -w /etc/passwd -p wa -k passwd_changes
    -w /etc/shadow -p wa -k shadow_changes
    -w /etc/sudoers -p wa -k sudoers_changes

## Tips

- Use meaningful keys (-k) for easier searching later

- Test rules with auditctl before adding to permanent config

- Monitor audit log size - rotate or truncate when needed

- Use -i flag with ausearch for human-readable output

- Filter by failed operations (-sv no) to find security issues

- Regularly review audit logs with aureport

- Set appropriate disk space limits to prevent log overflow

- Use immutable rules (-e 2) in production for security

- Watch executable directories to detect unauthorized binaries

- Monitor sudo/su usage to track privilege escalation

- Combine file watches with syscall rules for comprehensive monitoring

- Use keys to categorize events for easier analysis

- Check audit.log regularly to ensure auditing is working

- Use ausearch with time ranges for forensic investigations

- Archive old audit logs for compliance requirements

← Back to cheatsheets

← Home