pratyush/arch-conf-install
Archived
1
0
Fork 0
Code Issues 5 Pull Requests Projects 1 Releases Wiki Activity
This repository has been archived on 2022-06-28. You can view files and clone it, but cannot push or open issues or pull requests.
9a5db04928
arch-conf-install/services/audit-framework/audit.md

448 B
Raw Blame History

Audit Framework

Kernel

To ensure that all process which may have started before auditd are marked as auditable use boot time kernel param audit=1.

Userspace

  • Install the audit package, enable and start the auditd.service.
  • The config file is auditd.conf.
  • The rules are defined in /etc/audit/audit.rules.
  • auditctl can be used to edit rules on the fly.
  • ausearch and aureport are used to summarize and view data.