How to Configure auditd for Security Event Logging on Ubuntu

Enterprise compliance frameworks like SOC 2, PCI-DSS, and CIS Benchmarks require comprehensive, tamper-evident audit logging for privileged system operations. While standard systemd journal logs record application output, they fail to track low-level kernel system calls, unauthorized file reads, privilege escalation attempts, or network socket bindings. The Linux Audit Daemon (auditd) hooks directly into the Linux kernel audit subsystem, capturing precise records of who executed what binary, accessed which file, and altered system security states.

auditd Architecture and Kernel Hooking

The Linux audit subsystem consists of two operational tiers:

• Kernel-Level Audit Filter: Integrated directly into the kernel execution path. It inspects system calls (e.g., open, execve, unlink) against active audit rules with negligible processing overhead before events reach userland.
• auditd Daemon: A userspace daemon listening on a Netlink socket that receives audit records from the kernel and writes them to protected log files located in /var/log/audit/audit.log.

Installing auditd and Verifying Service Health

Install the audit daemon and user utilities package on Ubuntu:

sudo apt update
sudo apt install auditd audispd-plugins -y

# Enable and start the service
sudo systemctl enable --now auditd.service

# Verify kernel audit status
sudo auditctl -s

Defining Persistent Audit Rules in /etc/audit/rules.d/

Audit rules configured dynamically via auditctl reset on reboot. Deploy persistent rules by creating configuration files within /etc/audit/rules.d/:

sudo nano /etc/audit/rules.d/99-security-hardening.rules

Add rules to monitor sensitive configuration files and privileged system calls:

## Remove all existing rules
-D

## Set buffer size
-b 8192

## Failure mode: 1 = syslog, 2 = kernel panic (strict compliance)
-f 1

## Monitor changes to user accounts and authentication databases
-w /etc/passwd -p wa -k identity_changes
-w /etc/shadow -p wa -k identity_changes
-w /etc/group -p wa -k identity_changes
-w /etc/gshadow -p wa -k identity_changes
-w /etc/security/opasswd -p wa -k identity_changes

## Monitor sudoers and privilege configuration
-w /etc/sudoers -p wa -k privilege_escalation
-w /etc/sudoers.d/ -p wa -k privilege_escalation

## Monitor system network configuration
-w /etc/hosts -p wa -k network_config
-w /etc/network/ -p wa -k network_config
-w /etc/netplan/ -p wa -k network_config

## Track execution of privileged binaries
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k sudo_execution
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k su_execution

Generate the master audit.rules file and reload the daemon:

sudo augenrules --load

Searching and Analyzing Audit Logs with ausearch and aureport

Raw audit logs in /var/log/audit/audit.log contain dense hexadecimal representations. Use specialized command-line diagnostic tools to parse events quickly:

# Search for identity changes by rule key
sudo ausearch -k identity_changes -i

# Search for failed system calls across the entire system
sudo ausearch --failed -i

# Generate an executive security audit summary report
sudo aureport --summary

The flag -i (interpret) automatically converts numeric user IDs (UIDs), system calls, and hexadecimal filenames into readable plaintext names, streamlining incident response across Ubuntu environments.