https://lead-devops.blackdevhub.online/en/tags/audit/Recent content in Audit on Lead DevOpsHugoen-USSat, 05 Sep 2026 00:00:00 +0000https://lead-devops.blackdevhub.online/en/posts/auditd-file-syscall-logging/Sat, 05 Sep 2026 00:00:00 +0000https://lead-devops.blackdevhub.online/en/posts/auditd-file-syscall-logging/<p>Linux doesn&rsquo;t write every access to <code>/etc/shadow</code> or every <code>unlink</code> call to syslog. For incident investigation and compliance this is critical. auditd solves this: the Linux Audit kernel subsystem records system calls, file access, and more.</p> <h2 id="installation-and-startup">Installation and Startup </h2> <p>auditd comes in the <code>audit</code> package available in any distribution.</p> <div class="td-code td-code--untitled" id="td-code-b9f47e43-fence-0" data-td-code data-td-code-auto-id data-td-language="bash" data-td-line-count="8"> <div class="td-code__viewport" id="td-code-b9f47e43-fence-0-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Debian/Ubuntu</span> </span></span><span class="line"><span class="cl">apt install auditd </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># RHEL/CentOS/Alma</span> </span></span><span class="line"><span class="cl">yum install audit </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># Arch</span> </span></span><span class="line"><span class="cl">pacman -S audit</span></span></code></pre></div></div> </div> <p>After installation, start the service via systemd.</p>