Linux Auditd Blueprint: Real-Time Kernel Event Tracking & Security Auditing

1. Auditd Framework Architecture & Kernel Interception

The Linux Audit Subsystem is embedded directly inside the Linux kernel. It hooks system calls at the kernel boundary, capturing process executions, file access attempts, network socket creations, and user authentication events before processes complete.

Unlike standard syslog daemons (which depend on applications choosing to log messages), auditd intercepts events unconditionally at the system call level, making it tamper-resistant against user-space log manipulation.

The user-space auditd daemon collects events from kernel netfilter buffers and writes them to /var/log/audit/audit.log.

This granular logging capability forms the core foundation of Digital Forensics and Incident Response (DFIR) on Linux servers.

# Install auditd on Debian/Ubuntu
systemctl enable --now auditd

# Verify audit daemon status
auditctl -s

2. Auditing Process Execution (execve) across All Users

Attackers who gain initial shell access execute reconnaissance commands (such as whoami, id, uname -a, netstat). Standard bash history can be deleted or bypassed by executing binaries directly.

Adding execve audit rules records every single binary execution across the entire system, capturing exact command-line arguments, working directories, parent PIDs, and effective user IDs (EUID).

Filter by arch=b64 to capture 64-bit system calls efficiently.

Capturing full command-line arguments provides immutable forensic evidence during post-compromise investigations.

# Track 64-bit and 32-bit execve system calls
-a always,exit -F arch=b64 -S execve -k process_exec
-a always,exit -F arch=b32 -S execve -k process_exec

3. File Integrity Monitoring (FIM) for Critical System Files

File Integrity Monitoring (FIM) rules watch critical system configuration files for write (w), read (r), execute (x), or attribute change (a) operations.

Configure file watches on /etc/passwd, /etc/shadow, /etc/sudoers, and /etc/pam.d/ to alert DFIR incident responders immediately if account credentials or privilege policies are modified.

Assign custom key tags (-k ) to audit rules to facilitate rapid filtering in log analysis tools.

Monitoring permissions changes on SSH configuration files (/etc/ssh/sshd_config) prevents unauthorized backdoor insertion.

# File Integrity Watch Rules
-w /etc/passwd -p wa -k identity_changes
-w /etc/shadow -p wa -k identity_changes
-w /etc/sudoers -p wa -k privilege_changes
-w /etc/sudoers.d/ -p wa -k privilege_changes
-w /var/log/tallylog -p wa -k auth_logs

4. Structuring Modular Audit Rules in /etc/audit/rules.d/

Modern Linux distributions manage audit rules through modular files in /etc/audit/rules.d/*.rules, which augments auditctl when auditd starts.

Organize rules into numbered files (e.g., 10-base.rules, 30-fim.rules, 90-finalize.rules) to maintain clear rule precedence.

Enforce rule immutability by appending -e 2 as the final directive, preventing attackers from disabling audit rules without a reboot.

Immutable rules guarantee log integrity even if an attacker achieves temporary root privileges.

# /etc/audit/rules.d/99-finalize.rules
# Lock audit rules until next reboot
-e 2

5. Performance Tuning & Buffer Backlog Management

Under high system load, kernel audit buffers can overflow if the auditd daemon cannot write to disk fast enough, causing kernel event drops.

Tune kernel backlog buffer limits (-b) and set failure response actions (-f) in /etc/audit/rules.d/10-base.rules to handle burst traffic gracefully.

Configuring backlog buffers to 8192 prevents event drops during bursty web application workloads.

# /etc/audit/rules.d/10-base.rules
-D
-b 8192
-f 1

6. Incident Response & Log Querying via ausearch & aureport

The audit log file (/var/log/audit/audit.log) contains dense key-value pairs. Use built-in utilities ausearch and aureport for forensic queries.

Use aureport --summary to generate high-level executive reports on failed authentications, executable events, and file access violations.

Combine ausearch with jq or SIEM log forwarders (Elastic Filebeat, Vector) to stream structured audit events to central security operating centers.

# Query process execution events by key tag
ausearch -k process_exec -i

# Generate summary report of failed login attempts
aureport -l --failed

# Query modifications to /etc/sudoers
ausearch -k privilege_changes -i

Written by Zyekh Abdul Qadir Jailani

Digital Forensics & Incident Response (DFIR) Specialist & Security Researcher specializing in Linux kernel hardening, threat hunting, and system security research.

LinkedIn • GitHub • Discord • Email • PGP Key