Auditd rules that matter for compliance

Watch the files and syscalls auditors actually ask about, tune rules by key, and keep signal high without drowning auditd in noise nobody reads.

auditd is the Linux kernel audit framework's userspace daemon. It records security-relevant events — who changed /etc/sudoers, who loaded a kernel module, who exec'd /usr/bin/passwd — as immutable-ish log lines with timestamps, uids, and syscalls. Compliance frameworks name specific objects to monitor; the art is covering those without generating gigabytes of useless noise nobody reads before retention expires.

Start with CIS benchmark watch lists for your distro, then subtract rules your SIEM already covers via FIM or EDR to avoid duplicate alerts.

This note configures rules in /etc/audit/rules.d/, groups them by key for reporting, and tunes exclusions for high-volume paths. For log shipping and search, pair with Linux detection engineering and journal forwarding; Linux hardening covers the broader host baseline audit supports.

Rules that auditors actually ask for

Watch identity files (/etc/passwd, /etc/group, /etc/shadow), privilege escalation (/etc/sudoers, setuid execs), and kernel module loads. Use -F arch=b64 on x86_64 for clarity. Assign a -k key per control so ausearch -k identity pulls a report without grep gymnastics.

Immutable rules (-e 2 in audit.rules on supported systems) prevent runtime tampering without reboot — useful for high-assurance hosts. Pair watched files with file integrity monitoring alerts when audit volume is too high for real-time SIEM ingest. Map each -k key to a compliance control id in your SOC runbook.

-D
-b 8192
-f 1
 
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k priv_esc
-w /etc/sudoers.d/ -p wa -k priv_esc
 
-a always,exit -F arch=b64 -S init_module,delete_module -k module_load

Search and report by key

Raw /var/log/audit/audit.log is hostile to humans. ausearch filters by key, uid, time window, and executable. Ship logs to SIEM with the key field extracted — your detections become identity change alerts instead of regex on paths.

aureport --summary gives weekly stats for capacity planning — if execve events dominate, your filters need tightening before the disk fills. Rotate logs with logrotate or audisp-remote forwarding; audit logs must not be world-readable. Test rules in staging with production-like workload noise before enabling globally.

Where this goes next

Forward audit logs via rsyslog or the audit dispatcher to your SIEM. Correlate priv_esc keys with SSH session logs from journald pipelines. Linux detection engineering builds detections on audit fields; Linux hardening ensures the rules you audit actually match a locked-down host.

CIS and PCI mappings change — revalidate watched paths after major distro upgrades (/etc/authselect, renamed PAM files). Automate auditctl -l drift checks in configuration management so a reboot never loads an empty ruleset silently.

Related posts