auditd: Linux audit framework for compliance and forensics
Configure auditd to log syscalls, file access, and user actions for SOC2/PCI forensics and intrusion detection.
Why
auditd is the kernel-level audit framework required by PCI-DSS, SOC2, and HIPAA for logging who did what when. It captures syscalls (open, execve) that app logs miss, and survives tampering better than syslog.
Verizon's 2024 DBIR shows 68% of breaches involve a non-malicious human element. SSH key compromise and misconfigured S3 buckets are top attack vectors — hardening reduces breach risk by 80%+.
When
Use on any server subject to compliance (PCI, SOC2, HIPAA, FedRAMP) or where forensic capability is required. Avoid security theater (obscurity without depth) — a non-standard SSH port stops 0 real attacks.
Skip heavy WAF rules if you have no known vulnerabilities; they add latency and false positives.
How
Example
Common Problems
- ⚠auditd logs fill /var/log/audit/ and crash the server — set max_log_file and num_logs in auditd.conf.
- ⚠-e 2 makes rules immutable; you can't add rules without a reboot — use -e 1 in dev, -e 2 in prod.
- ⚠Excessive execve logging on a busy app server generates GB/day — filter by auid or specific binaries.
Best Practices
- ✓Forward audit logs to a SIEM (Splunk, Elastic, Wazuh) via audispd or auditbeat so an attacker can't tamper locally.
- ✓Use keys (-k) on every rule so ausearch -k <key> gives targeted queries instead of grepping the whole log.
- ✓Set -e 2 in production to make rules immutable; require a reboot to change, preventing runtime tampering.
FAQ
What is auditd: Linux audit framework for compliance and forensics and what problem does it solve?
Configure auditd to log syscalls, file access, and user actions for SOC2/PCI forensics and intrusion detection. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.
How do I get started with auditd: Linux audit framework for compliance and forensics in 5 minutes?
Two steps to run it: (1) Install: `apt install auditd audispd-plugins`.; (2) Rules in /etc/audit/rules.d/audit.rules.. Validate on the free tier first, then wire into production.
What is the #1 pitfall with auditd: Linux audit framework for compliance and forensics?
The most frequent issue is: auditd logs fill /var/log/audit/ and crash the server — set max_log_file and num_logs in auditd.conf.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.
What are the best practices for auditd: Linux audit framework for compliance and forensics?
Best practices for auditd: Linux audit framework for compliance and forensics include: Forward audit logs to a SIEM (Splunk, Elastic, Wazuh) via audispd or auditbeat so an attacker can't tamper locally.; Use keys (-k) on every rule so ausearch -k <key> gives targeted queries instead of grepping the whole log.; Set -e 2 in production to make rules immutable; require a reboot to change, preventing runtime tampering.. The first one — "Forward audit logs to a SIEM (Splunk, Elastic, Wazuh) via audispd or auditbeat so an attacker can't tamper locally." — should be a team default baked into your IaC templates.
How do I control cost and avoid bill surprises with auditd: Linux audit framework for compliance and forensics?
Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most auditd: Linux audit framework for compliance and forensics options offer a free tier — validate within free quota before scaling.