Post Date: February 24, 2019
Last Updated: October 09, 2026
Introduction
The Linux Audit Daemon (auditd) is a key component of the Linux Auditing System. It records security-related events and activities on a Linux server, helping administrators monitor system changes, investigate suspicious activity, and maintain an audit trail.
By configuring audit rules, administrators can monitor specific system calls, file access, changes to sensitive files, and other security-relevant events.
In this guide, we will explain how to install, enable, and configure the auditd service on CentOS 7.
Prerequisites
Before configuring the Auditd service, ensure that the following requirements are met.
Linux Server Access
You need SSH access to the Linux server with root or sudo privileges.
Supported Operating System
The commands in this guide are intended for CentOS 7. For newer Linux distributions, package management and service configuration may differ.
Administrative Permissions
You need sufficient privileges to install packages, manage system services, and modify audit configuration files.
Implementation
Step 1: Install the Audit Packages
The Linux Auditing System uses the audit and audit-libs packages.
Install the Auditd package on CentOS 7 using:
sudo yum install audit
The package manager will install the required dependencies.
Step 2: Verify the Audit Packages
Check whether the audit packages are installed:
sudo yum list installed audit audit-libs
This command displays the installed versions of the audit packages.
Step 3: Enable the Auditd Service
Enable the Auditd service so that it starts automatically when the server boots:
sudo systemctl enable auditd.service
This ensures that the auditing service is configured to start during system startup.
Step 4: Start the Auditd Service
Start the service using:
sudo systemctl start auditd.service
Verify its current status:
sudo systemctl status auditd.service
Confirm that the service is active and running.
Step 5: Configure Auditd Settings
The Auditd configuration file is generally located at:
/etc/audit/auditd.conf
Open the configuration file:
sudo nano /etc/audit/auditd.conf
You can configure settings such as:
log_file— Specifies the audit log file location.num_logs— Specifies the number of rotated audit log files to retain.max_log_file— Sets the maximum size of an audit log file in megabytes.max_log_file_action— Defines the action to take when the audit log reaches its configured size limit.space_left_action— Specifies an action when available disk space reaches the configured threshold.
Review the existing values and adjust them according to your server’s storage capacity, audit requirements, and log retention policy.
Save the file after making the necessary changes.
Step 6: Configure Audit Rules
Auditd records events according to the active audit rules. You can inspect the current rules with:
sudo auditctl -l
To monitor access to a sensitive file, you can add a temporary watch rule. For example:
sudo auditctl -w /etc/passwd -p wa -k identity_changes
This rule monitors write and attribute-change access to /etc/passwd and labels matching events with the key identity_changes.
To make custom rules persistent across reboots, configure them in the appropriate audit rules file, commonly:
/etc/audit/rules.d/audit.rules
The exact persistent rule configuration depends on the distribution and its audit rule-loading mechanism. Validate the rules before applying them on production systems.
Step 7: Review Audit Logs
Audit records are commonly stored in:
/var/log/audit/audit.log
View recent entries using:
sudo tail -n 50 /var/log/audit/audit.log
To search for events associated with the rule created earlier, use:
sudo ausearch -k identity_changes
Review the output to identify relevant file access and modification events.
Step 8: Verify the Audit Configuration
After completing the configuration, check the service status and active audit rules:
sudo systemctl status auditd.service sudo auditctl -l
Confirm that the expected rules are active and that audit events are being recorded.
Conclusion
The Auditd service helps Linux administrators monitor security-related events, maintain audit records, and investigate changes to critical system files.
By installing and enabling Auditd, configuring log management, creating appropriate audit rules, and reviewing audit records regularly, administrators can improve server visibility and strengthen security monitoring.
However, Auditd alone does not make a server secure. It should be used alongside access controls, security updates, firewall configuration, log monitoring, and regular security reviews.
Note: CentOS 7 reached end of life on June 30, 2024. For new deployments, use a currently supported Linux distribution and follow its recommended auditing configuration.
Frequently Asked Questions
What is Auditd in Linux?
Auditd is the userspace component of the Linux Auditing System responsible for recording audit events generated by the kernel and configured audit rules.
Why is Auditd important for server security?
It helps administrators track security-relevant events, monitor sensitive files, investigate suspicious activity, and maintain records for security reviews.
Where are Auditd logs stored?
The default audit log location is commonly /var/log/audit/audit.log, although the location can be changed in the Auditd configuration.
How can I check whether Auditd is running?
Run the following command:
sudo systemctl status auditd.service
Review the output to confirm whether the service is active.
How can I view active audit rules?
Use:
sudo auditctl -l
This displays the audit rules currently loaded into the running system.
Does enabling Auditd automatically monitor every server activity?
No. Auditd records events according to the active audit configuration and rules. Administrators must define appropriate rules to capture the events relevant to their security requirements.
Can Auditd logs consume significant disk space?
Yes. High-volume audit rules can generate large amounts of data. Configure log rotation, retention, disk-space alerts, and appropriate audit rules to prevent excessive storage consumption.
Related Articles
Modifying File Timestamps in Linux Using touch
How the Linux Kernel Handles Network Connections Using DNS and Routing
Need Help Securing Your Linux Server?
Need help configuring Linux auditing or strengthening your server security? Our team can assist with Auditd configuration, security monitoring, access control, log management, server hardening, troubleshooting, and ongoing Linux server administration. Get in touch with our team here.