How to Use the auditd Daemon to Monitor File Integrity and System Calls in Linux

In security-hardened environments and compliance frameworks (such as PCI-DSS, SOC 2, and HIPAA), administrators must maintain an immutable, tamper-evident record of all privileged security events. Standard system logs like syslog record only what applications choose to log, omitting critical kernel-level events like file attribute tampering, unauthorized permission changes, and root privilege escalation. The Linux Audit Subsystem (auditd) operates directly within the Linux kernel, capturing system calls, process executions, and file access events in real time.

Understanding the Linux Audit Subsystem Architecture

The audit subsystem consists of kernel components and user-space utilities:

• Kernel Audit Hooks: Intercept system calls (e.g., open, unlink, chmod, setuid) at the kernel level based on defined rules.
• auditd: The user-space daemon that receives audit records from the kernel netlink socket and writes them reliably to /var/log/audit/audit.log.
• auditctl: Administrative utility used to load, query, and modify active kernel audit rules.
• ausearch & aureport: Query and reporting tools that parse binary and raw text audit records into structured investigation timelines.

Installing and Enabling auditd on Linux

Install the audit daemon and user utilities across Ubuntu or Debian systems:

sudo apt update
sudo apt install auditd audispd-plugins -y

Enable and start the service:

sudo systemctl enable --now auditd

Confirm the audit subsystem is active in the kernel:

sudo auditctl -s

The output reports enabled 1 and displays current buffer limits and backlog queue sizes.

Defining File Integrity Watches with auditctl

A file watch rule triggers an audit record whenever a specific file or directory is accessed, modified, or executed.

Monitor critical authentication files for write or attribute modifications:

# Watch /etc/passwd for writes and attribute changes with key 'identity_tamper'
sudo auditctl -w /etc/passwd -p wa -k identity_tamper

# Watch /etc/shadow for any read, write, or attribute change
sudo auditctl -w /etc/shadow -p rwa -k shadow_access

# Watch the SSH configuration directory recursively
sudo auditctl -w /etc/ssh/ -p wa -k sshd_config_change

The -p parameter specifies permission filters: r (read), w (write), x (execute), and a (attribute changes). The -k flag assigns a searchable keyword tag, simplifying future log searches.

Auditing Execution of Privileged System Calls

To detect unauthorized privilege escalation, monitor 64-bit system calls for process identification changes:

sudo auditctl -a always,exit -F arch=b64 -S setuid,setgid,setreuid -F key=priv_escalation

List all currently loaded in-memory rules:

sudo auditctl -l

Persisting Audit Rules in audit.rules

Rules set via auditctl reset upon system reboot. To make rules permanent across reboots, add them to /etc/audit/rules.d/audit.rules:

sudo nano /etc/audit/rules.d/audit.rules

Add your watch rules at the bottom of the file:

-w /etc/passwd -p wa -k identity_tamper
-w /etc/shadow -p rwa -k shadow_access
-w /etc/sudoers -p wa -k sudoers_change
-a always,exit -F arch=b64 -S setuid,setgid -F key=priv_escalation

Reload the rule definitions using augenrules:

sudo augenrules --load

Querying Audit Logs Using ausearch and aureport

Rather than manually reading /var/log/audit/audit.log, use specialized query tools:

• Search by Rule Key: Find all audit events matching the identity_tamper key:

  sudo ausearch -k identity_tamper --interpret

  The --interpret flag automatically translates numeric User IDs (UIDs) and system call numbers into readable usernames and function names.

• Search by Command Name or Executable:

  sudo ausearch -c passwd --interpret

• Generate Executive Summary Reports: Summarize all failed system calls and authentication attempts:

  sudo aureport --failed --summary