Overview

auditd is the userspace half of the Linux Auditing System — the daemon that receives the audit events the kernel produces and writes them to disk. The kernel side hooks into the system-call path, so a rule can record who ran what, which file was opened or modified, which account changed, or why a process was denied by SELinux/AppArmor — and auditd serialises those records into a tamper-evident log that survives reboots and log rotation.

The framework exists to satisfy the requirements of Common Criteria, PCI-DSS and comparable standards: every event carries the date and time, the type of event, the subject identity, the object acted upon and the result (success or failure). Rules are configured with auditctl (or compiled from /etc/audit/rules.d/ by augenrules), the daemon’s behaviour is tuned in /etc/audit/auditd.conf, and the log is queried with ausearch, aureport and the auparse library. The userspace code lives in the linux-audit/audit-userspace repository (GPL-2.0, C, actively maintained — commits landed in October 2026) and is packaged by every major distribution: Debian 13 and Ubuntu ship 4.0.2 as auditd, RHEL/Fedora as audit.

Key Features

• Kernel-level syscall interception — auditing happens in the kernel before the action completes, so events cannot be hidden by a userspace process. Rules can match on syscall number, architecture (arch=b64/b32), path, inode, UID/GID, exit value, success/perm and command-line arguments.
• File watches and directory recursion — auditctl -w /etc/passwd -p wa -k identity logs writes and attribute changes to a file or tree; the modern -F path= form and exclude filters (-F dir=/var/lib/docker -F perm=x -F key=exclude) keep noisy subtrees out of the log.
• Rule sets that survive reboot — persistent rules belong in /etc/audit/rules.d/*.rules; augenrules compiles them into audit.rules, which auditctl loads at boot. -e 2 locks the configuration immutably: further changes are denied and audited until the machine reboots — the tamper-resistance switch regulators ask for.
• Queryable, structured log — ausearch searches by key, user, syscall, file, PID, time range or msg=audit() id; -i resolves UIDs, syscall numbers and socket addresses into human-readable text; --format csv/text feed SIEMs. aureport aggregates the same data into file, login, auth, exec, AVC and anomaly summary reports.
• Real-time distribution to plugins — the audit dispatcher (audispd / auditd‘s plugin framework) streams events over an AF_UNIX socket to whichever plugins are enabled, including a syslog plugin and remote-logging for krb5/GSSAPI and zos-remote (LDAP) transports, so logs also reach a central collector.
• Log management and failure modes — auditd.conf controls rotation (max_log_file, num_logs, max_log_file_action), low-space behaviour (space_left_action, admin_space_left_action, disk_full_action, disk_error_action) and what the kernel does when it loses the daemon (auditctl -f 0|1|2 — silent, printkernel, panic). SIGUSR1 rotates on demand.
• Companion utilities — autrace follows a single process’s syscalls, ausyscall maps syscall names and numbers for any architecture, aulast/aulastlog rebuild login history from the audit trail, auvirt reports on virtualisation events, and the Python bindings plus the auparse C library let you script your own analysis.

Why Use It

Log files written by applications can be edited by whoever owns the process; auditd’s records come from the kernel and can be made immutable for the life of the boot. That is the difference between “the application says it did not touch that file” and evidence. For compliance work it is also the shortest path to the specific evidence a standard demands — privileged-command execution, account and group changes, authentication failures, file-integrity watchpoints, mandatory-access-control denials — rather than a general-purpose log you have to shape by hand. Because the rule language is stable and the log format is well documented and machine-parseable, the same ruleset can be versioned in configuration management and shipped across an estate, with the output feeding your existing SIEM.

Use Cases

• Regulatory and standards compliance — produce the syscall, account-change, privileged-execution and file-watch evidence required by PCI-DSS, Common Criteria, CIS Benchmark and NIST-derived baselines.
• Intrusion detection and forensics — keep watchpoints on /etc/passwd, /etc/shadow, /etc/sudoers, SSH configuration and your own application paths, then reconstruct an incident from ausearch by key, time and session.
• Privileged activity accountability — record every execve and every sudo/su with the login UID and session ID, so root actions are attributable to a person, not a service account.
• Mandatory access control auditing — collect SELinux and AppArmor AVC denials, then turn them into policy fixes with aureport --avc and ausearch -m avc.
• Change detection on servers — watch the configuration and binary directories that must never change silently (/etc, /usr/bin, /boot) and alert on writes outside a deployment window.
• Centralised security logging — forward events to syslog or a remote collector with the audit plugins so a compromised host cannot quietly delete its own trail.

Platforms

Linux only — the audit subsystem is a kernel feature. Upstream targets kernel 5.15 or newer, systemd (an OpenRC init script is available, as used by Alpine) and coreutils. Supported architectures are x86_64 and i386, AArch64, ARM, POWER/POWERLE, s390/s390x and riscv32/riscv64 (upstream has a moratorium on new ports). Packages exist for Debian/Ubuntu (auditd), Fedora/RHEL/CentOS (audit), Alpine, SUSE and Arch, and the project also builds from source with autoconf/automake, with optional Python, Go and SWIG bindings.

Licence and Website

Free and open source. audit-userspace is released under the GNU General Public License v2.0 — the repository’s COPYING file carries the GPL v2 text, and GitHub reports the repository licence as GPL-2.0. Source, releases and the issue tracker are at github.com/linux-audit/audit-userspace; the kernel-side counterpart is kernel/audit.c in the mainline tree.

Alternatives

• Falco — runtime threat detection on syscall and Kubernetes audit streams
• chkrootkit — rootkit signature and integrity scanning for Unix systems
• YARA — pattern-matching rules for identifying and classifying malware
• Browse more security and privacy tooling in the directory