مرکز آموزش

auditd is the Linux kernel's auditing framework, recording detailed logs of security-relevant system events — file access, command execution, authentication attempts — useful for both security monitoring and compliance requirements.

Prerequisites

• Ubuntu 22.04/24.04 or Debian 11/12 VPS
• Root or sudo access

Step 1 — Install auditd

sudo apt update
sudo apt install auditd audispd-plugins -y

Step 2 — Enable and Start the Service

sudo systemctl enable auditd
sudo systemctl start auditd
sudo systemctl status auditd

Step 3 — Understanding Audit Rules

Rules are added via auditctl (temporary) or defined permanently in /etc/audit/rules.d/audit.rules.

Step 4 — Monitor Changes to a Critical File

sudo auditctl -w /etc/passwd -p wa -k passwd_changes

-w specifies the file to watch, -p wa watches for writes and attribute changes, -k assigns a searchable key name.

Step 5 — Monitor Command Execution

sudo auditctl -a always,exit -F arch=b64 -S execve -k command_execution

Step 6 — Make Rules Permanent

sudo nano /etc/audit/rules.d/audit.rules

-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/ssh/sshd_config -p wa -k sshd_config_changes
-w /etc/sudoers -p wa -k sudoers_changes

sudo systemctl restart auditd

Step 7 — Search Audit Logs by Key

sudo ausearch -k passwd_changes

Step 8 — Search by Time Range

sudo ausearch -k sudoers_changes --start today

Generating Summary Reports

sudo aureport --summary

Specific reports:

sudo aureport -au    # authentication events
sudo aureport -f     # file access events

Recommended Baseline Rules for VPS Security

-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k privilege_escalation
-w /etc/ssh/sshd_config -p wa -k ssh_config
-w /var/log/auth.log -p wa -k auth_log
-a always,exit -F arch=b64 -S execve -k command_execution

Managing Log Size

sudo nano /etc/audit/auditd.conf

max_log_file = 50
num_logs = 10

Controls log rotation to prevent unbounded disk growth.

Common Errors

"Error - /var/log/audit/audit.log is not a regular file" — check for a misconfigured log path or permissions issue.

Rules disappear after reboot — ensure rules are defined in /etc/audit/rules.d/audit.rules, not just added temporarily with auditctl.

Best Practices

• Focus rules on genuinely security-relevant files and events, not everything — excessive logging creates noise and consumes resources
• Regularly review audit logs, or forward them to centralized logging — see How to Set Up Centralized Logging Across Multiple VPS Instances
• Combine with Fail2Ban and log monitoring for comprehensive coverage

Continue Reading

• How to Monitor Auth Logs and Detect Intrusion Attempts
• How to Conduct a Security Audit of Your VPS
• How to Set Up File Integrity Monitoring with AIDE

Browse more articles in Advanced Security & Compliance.