With Linux Audit, you can track security-relevant information about your system. By following preconfigured rules, Audit generates log entries to record as much information as possible about events on your system. This information is crucial to determine the violator of the security policy.

Audit can record, for example, the following information in its log files:

• Date and time, type, and outcome of an event
• Sensitivity labels of subjects and objects
• Association of an event with the identity of the user who triggered the event
• All modifications to Audit configuration and attempts to access Audit log files
• All uses of authentication mechanisms, such as SSH, Kerberos, and others
• Changes to any trusted database, such as /etc/passwd
• Attempts to import or export information into or from the system
• Include or exclude events based on user identity, subject and object labels, and other attributes

The use of the Audit system is also a requirement for several security-related certifications. Audit is designed to meet or exceed the requirements of the following certifications or compliance guides:

• Controlled Access Protection Profile (CAPP)
• Labeled Security Protection Profile (LSPP)
• Rule Set Base Access Control (RSBAC)
• National Industrial Security Program Operating Manual (NISPOM)
• Federal Information Security Management Act (FISMA)
• Payment Card Industry - Data Security Standard (PCI-DSS)
• Security Technical Implementation Guides (STIG)

Audit has also been evaluated by National Information Assurance Partnership (NIAP) and Best Security Industries (BSI). You can use Audit for:

Watching file access

Audit can track whether a file or a directory has been accessed, modified, executed, or the file’s attributes have been changed. This is useful, for example, to detect access to important files and have an Audit trail available in case one of these files is corrupted.

Monitoring system calls

Audit can be configured to generate a log entry every time a particular system call is used. This can be used, for example, to track changes to the system time by monitoring the settimeofday, clock_adjtime, and other time-related system calls.

Recording commands run by a user

Audit can track whether a file has been executed, so rules can be defined to record every execution of a particular command. For example, a rule can be defined for every executable in the /bin directory. The resulting log entries can then be searched by user ID to generate an audit trail of executed commands per user.

Recording execution of system path names

Aside from monitoring file access which translates a path to an inode at rule invocation, Audit can now monitor the execution of a path even if it does not exist at rule invocation, or if the file is replaced after rule invocation. This allows rules to continue to work after upgrading a program executable or before it is even installed.

Recording security events

The pam_faillock authentication module is capable of recording failed login attempts. Audit can be configured to record failed login attempts as well and provides additional information about the user who attempted to log in.

Searching for events

Audit provides the ausearch utility, which can be used to filter the log entries and provide a complete audit trail based on several conditions.

Running summary reports

The aureport utility can be used to generate, among other things, daily reports of recorded events. A system administrator can then analyze these reports and investigate suspicious activity further.

Monitoring network access

The nftables, iptables, and ebtables utilities can be configured to trigger Audit events, allowing system administrators to monitor network access.

Note

Audit affects system performance depending on the amount of information collected.