Auditd: Difference between revisions
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
'''Auditd''' - is the userspace component of the Linux Auditing System<ref>[https://linux.die.net/man/8/auditd] auditd - Linux man page</ref>. It is responsible for writing audit records to the disk. '''The Linux Auditing System''' helps system administrators to create an audit trail, a log for every action on the server. Since '''Auditd''' operates at the kernel level, this gives system administrators an opportunity to get detailed information about any system operation. '''The Linux Audit System''' provides a way to track security-relevant information on the system. Based on pre-configured rules, '''Auditd''' generates log entries to record as much information about the events that are happening on the system as possible. System administrators can choose which actions on the server should be monitored and to what extent. This information is crucial for mission-critical environments to determine the violator of the security policy and the actions they performed. '''Auditd''' does not provide additional security to the system, rather it can be used to discover violations of security policies used on the system. These violations can further be prevented by additional security measures such as SELinux. '''The Linux Audit System''' is developed and maintained by '''RedHat'''<ref>[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html] Chapter 7.System Auditing</ref>. | '''Auditd''' - is the userspace component of the Linux Auditing System<ref>[https://linux.die.net/man/8/auditd] auditd - Linux man page</ref>. It is responsible for writing audit records to the disk. '''The Linux Auditing System''' helps system administrators to create an audit trail, a log for every action on the server. Since '''Auditd''' operates at the kernel level, this gives system administrators an opportunity to get detailed information about any system operation. '''The Linux Audit System''' provides a way to track security-relevant information on the system. Based on pre-configured rules, '''Auditd''' generates log entries to record as much information about the events that are happening on the system as possible. System administrators can choose which actions on the server should be monitored and to what extent. This information is crucial for mission-critical environments to determine the violator of the security policy and the actions they performed. '''Auditd''' does not provide additional security to the system, rather it can be used to discover violations of security policies used on the system. These violations can further be prevented by additional security measures such as SELinux. '''The Linux Audit System''' is developed and maintained by '''RedHat'''<ref>[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html] Chapter 7.System Auditing</ref>. | ||
==Usage and use cases== | |||
==Audit system architecture== | |||
==Installation of Audit packages== | |||
==Starting the Audit service== | |||
==Defining Audit rules== | |||
===Defining Audit rules with '''auditctl''' utility=== | |||
===Defining persistent Audit rules and controls=== | |||
==Understanding Audit log files== | |||
==Searching the Audit log files== | |||
==Creating Audit reports== | |||
==References== | ==References== | ||
Revision as of 21:32, 11 March 2017
Auditd - is the userspace component of the Linux Auditing System[1]. It is responsible for writing audit records to the disk. The Linux Auditing System helps system administrators to create an audit trail, a log for every action on the server. Since Auditd operates at the kernel level, this gives system administrators an opportunity to get detailed information about any system operation. The Linux Audit System provides a way to track security-relevant information on the system. Based on pre-configured rules, Auditd generates log entries to record as much information about the events that are happening on the system as possible. System administrators can choose which actions on the server should be monitored and to what extent. This information is crucial for mission-critical environments to determine the violator of the security policy and the actions they performed. Auditd does not provide additional security to the system, rather it can be used to discover violations of security policies used on the system. These violations can further be prevented by additional security measures such as SELinux. The Linux Audit System is developed and maintained by RedHat[2].
