How to Use the auditd and ausearch Commands in Linux for Security Event Logging and File Integrity Monitoring

Maintaining regulatory compliance (such as PCI-DSS, SOC 2, or HIPAA) and forensic readiness on production Linux servers requires tracking which users, services, and system calls access sensitive configuration files or execute administrative commands. Standard syslog daemons record only high-level application messages, missing unauthorized file modifications and privilege escalations. The Linux Auditing System (governed by auditd) operates directly at the kernel layer, intercepting system calls and logging detailed audit events that can be searched and decoded using ausearch and aureport.

Installing and Enabling auditd on Linux

The Linux Audit daemon is available across all major enterprise distributions:

# On Ubuntu and Debian systems
sudo apt update
sudo apt install auditd audispd-plugins -y

# On RHEL, Rocky Linux, and Fedora systems
sudo dnf install audit -y

Ensure the audit service is active and set to launch upon boot:

sudo systemctl enable --now auditd
sudo systemctl status auditd

Tool Name	Primary Capability	Operational Benefit
auditd	Kernel event capture daemon.	Writes cryptographically reliable system logs to /var/log/audit/audit.log.
auditctl	Live rule configuration tool.	Dynamically loads and unloads kernel audit filters.
ausearch	Targeted audit log query engine.	Filters events by user ID, executable, timestamp, or event tag.
aureport	Statistical audit reporting tool.	Generates consolidated summaries of failed logins, syscalls, and file events.

Configuring File Integrity Watch Rules with auditctl

A file watch rule instructs the kernel to log an audit event whenever a specified file or directory is read, written, executed, or attribute-changed:

# Syntax: auditctl -w <path> -p <permissions> -k <keyname>
# Watch /etc/passwd for writes and attribute changes
sudo auditctl -w /etc/passwd -p wa -k identity_changes

# Watch /etc/shadow for any access or modifications
sudo auditctl -w /etc/shadow -p rwa -k shadow_access

# List all active kernel audit rules
sudo auditctl -l

The -k flag assigns a searchable identifier key (e.g., identity_changes) to the rule, enabling instant filtering during incident analysis.

Making Audit Rules Persistent Across Reboots

Rules defined via auditctl reside in volatile kernel memory. To make rules persistent across system restarts, add them to /etc/audit/rules.d/audit.rules:

sudo nano /etc/audit/rules.d/audit.rules

Append enterprise security rules to monitor command executions by administrative users (UID 0):

# Monitor changes to the audit configuration itself
-w /etc/audit/ -p wa -k audit_config

# Monitor modifications to network configuration
-w /etc/netplan/ -p wa -k network_config

# Track execution of the execve syscall by non-system users (UID >= 1000)
-a always,exit -F arch=b64 -S execve -F auid>=1000 -F auid!=4294967295 -k user_commands

Reload the persistent rule set without restarting the server:

sudo augenrules --load

Querying and Interpreting Logs with ausearch

Audit log files in /var/log/audit/audit.log contain dense, raw hexadecimal data. Use ausearch with the -i (interpret) flag to translate numeric UIDs, syscall numbers, and file paths into human-readable text:

# Search for all events tagged with the identity_changes key
sudo ausearch -k identity_changes -i

# Search for all actions performed by user "developer" today
sudo ausearch -ua developer -ts today -i

# Locate failed system calls (potential unauthorized penetration attempts)
sudo ausearch -m SYSCALL -sv no -ts recent -i

Generating Executive Compliance Reports with aureport

To inspect macro-level security metrics across the system without parsing individual log entries:

# Summary of all login attempts (successful and failed)
sudo aureport -l

# Summary of executable commands run on the system
sudo aureport -x --summary

# Summary of file access events
sudo aureport -f --summary

Implementing auditd and ausearch establishes an immutable, forensic audit trail that satisfies rigorous enterprise security and regulatory compliance mandates.