Intermediate LevelLinux Commands & SysAdmin
How does auditd monitor file access, system calls, and user actions for security compliance?
❓ Interview Prompt: Explain auditd security auditing daemon, auditctl rule rules (/etc/audit/rules.d/), searching logs with ausearch, and reporting with aureport.
'auditd' is the Linux Audit daemon responsible for tracking system security events, file access attempts, and system calls for compliance auditing (SOC2, PCI-DSS, HIPAA):
Components:
•
'auditctl -w /etc/passwd -p wa -k identity_changes': Sets audit watch rule for write/attribute changes on '/etc/passwd'.
•
'ausearch -k identity_changes': Queries audit log events matching rule key.
•
'aureport': Generates summary compliance audit reports.
Code Implementation Example
bash
# Add audit rule watching changes to /etc/sudoers file
sudo auditctl -w /etc/sudoers -p wa -k sudoers_changes
# Search audit logs for identity change events
sudo ausearch -k sudoers_changes --summary💡Configuring auditd file watch rules and querying security logs.
🎯 Interview Key Takeaway
Use auditd watch rules on critical configuration files (/etc/passwd, /etc/sudoers) to maintain security compliance trails.
#auditd#Security Audit#Compliance#Intermediate
Back to all Linux Commands & SysAdmin Questions→