auditd#

Linux Audit Framework reference — kernel-level security auditing.

Commands#

CommandDescriptionintroWhat is auditd, architecture, quick startrulesauditctl watches, syscall rules, filtersconfigauditd.conf settings, rotation, disk actionssearchausearch by key, time, user, filereportaureport summaries, login, auth, filelogsaudit.log format, field meaningscomplianceCIS benchmark and PCI-DSS rulestoolsauditctl, audit2allow, aulast, autrace