Back to the article

auditd — security auditing

cheat sheet · Ubuntu 24.04 · auditd https://lab.dimsanych.ru/en/wiki/auditd/

Cheat sheet

sudo auditctl -w /etc/passwd -p wa -k passwd_changes watch a file
sudo auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -k root_cmd
sudo auditctl -l current rules
sudo auditctl -s subsystem status
sudo ausearch -k passwd_changes -i by key, readable
sudo aureport --summary
permanent: /etc/audit/rules.d/*.rules → augenrules --load