The Need for Deep System Auditing
If you suspect a server has been compromised, or if you simply need to enforce strict compliance standards (like HIPAA or PCI-DSS), looking at standard application logs (like /var/log/auth.log) is insufficient. Standard logs tell you if someone logged in, but they do not tell you exactly what that user did. Did they read a specific sensitive file? Did they execute a hidden script in the /tmp directory?
To answer these questions, Linux provides the Linux Audit Daemon (auditd). This framework integrates directly into the kernel, allowing it to monitor every system call, file access, and process execution in real time, with virtually no performance overhead. It is the ultimate forensic tool for Linux administrators.
Installing and Enabling auditd
On most modern enterprise distributions, auditd is either pre-installed or easily available via the default package manager.
For Debian/Ubuntu:
sudo apt update
sudo apt install auditd audispd-plugins
sudo systemctl enable --now auditd
For RHEL/CentOS/Rocky:
sudo dnf install audit
sudo systemctl enable --now auditd
How to Write Audit Rules
By default, auditd doesn’t log much beyond service start/stops. You must explicitly tell it what to watch using the auditctl command.
Monitoring a Specific File
Suppose you want to know if anyone (even the root user) modifies or deletes your SSH configuration file. You can set a watch rule:
sudo auditctl -w /etc/ssh/sshd_config -p wa -k ssh_config_changeBreakdown of the command:
-w(watch): The absolute path to the file or directory you want to monitor.-p(permissions): What specific actions to look for.ris read,wis write,xis execute, andais attribute change (like achmod). In this case, we are watching for writes and attribute changes (wa).-k(key): A custom tag you assign to this rule so you can easily search for it in the massive log file later.
Monitoring a Directory for Execution
Hackers often download malicious scripts to the /tmp directory because it is globally writable. You can use auditd to monitor for any execution attempts in that directory:
sudo auditctl -w /tmp -p x -k tmp_executionSearching the Audit Logs
The logs generated by auditd are stored in /var/log/audit/audit.log. Do not open this file with a text editor; it is dense and difficult to read. Instead, use the built-in search tool: ausearch.
Searching by Key
To see who triggered our SSH config watch rule, search by the custom key we created:
sudo ausearch -k ssh_config_changeSearching by User
To see every recorded action performed by a specific user (e.g., user ID 1000):
sudo ausearch -ua 1000Making Rules Permanent
Rules added via auditctl are loaded into memory and will be erased if the server reboots. To make them permanent, you must write them to the configuration files.
Open the rules file in your text editor:
sudo nano /etc/audit/rules.d/audit.rulesAdd your rules to the bottom of the file exactly as you typed them in the terminal, but omit the auditctl prefix:
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /tmp -p x -k tmp_execution
Save the file and restart the daemon (sudo systemctl restart auditd or sudo service auditd restart on older systems).
Conclusion
While UFW protects your perimeter and SSH keys protect your logins, auditd protects your internal filesystem. By configuring targeted watch rules on your most sensitive files and directories, you establish a permanent, tamper-proof forensic trail of exactly who did what on your Linux server.