thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Auditd

The Linux Audit daemon that records system calls, file access and security-relevant events based on configured rules.

Definition

Auditd rules (in /etc/audit/rules.d) can monitor execve calls, file access to sensitive files, privilege changes and user commands. Logs are written to /var/log/audit/audit.log and searched with ausearch and aureport. It is required by many compliance baselines.

Example

-w /etc/shadow -p wa -k shadow_changes watches writes to the shadow file.

Exam tip

ausearch and aureport are the tools for querying auditd logs.

Related terms