{"id":3651,"date":"2019-02-24T09:36:29","date_gmt":"2019-02-24T04:06:29","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=3651"},"modified":"2026-10-09T13:24:30","modified_gmt":"2026-10-09T07:54:30","slug":"how-to-secure-a-server-using-auditd-service","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/how-to-secure-a-server-using-auditd-service\/","title":{"rendered":"How to Secure a Linux Server Using the Auditd Service"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Post Date:<\/strong> February 24, 2019<br><strong>Last Updated:<\/strong> October 09, 2026<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Linux Audit Daemon (<code>auditd<\/code>) is a key component of the Linux Auditing System. It records security-related events and activities on a Linux server, helping administrators monitor system changes, investigate suspicious activity, and maintain an audit trail.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By configuring audit rules, administrators can monitor specific system calls, file access, changes to sensitive files, and other security-relevant events.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this guide, we will explain how to install, enable, and configure the <code>auditd<\/code> service on CentOS 7.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before configuring the Auditd service, ensure that the following requirements are met.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Linux Server Access<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You need SSH access to the Linux server with root or sudo privileges.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Supported Operating System<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The commands in this guide are intended for CentOS 7. For newer Linux distributions, package management and service configuration may differ.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Administrative Permissions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You need sufficient privileges to install packages, manage system services, and modify audit configuration files.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Implementation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Install the Audit Packages<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Linux Auditing System uses the <code>audit<\/code> and <code>audit-libs<\/code> packages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Install the Auditd package on CentOS 7 using:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo yum install audit\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The package manager will install the required dependencies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Verify the Audit Packages<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Check whether the audit packages are installed:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo yum list installed audit audit-libs\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This command displays the installed versions of the audit packages.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Enable the Auditd Service<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Enable the Auditd service so that it starts automatically when the server boots:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl enable auditd.service\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This ensures that the auditing service is configured to start during system startup.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Start the Auditd Service<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Start the service using:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl start auditd.service\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify its current status:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl status auditd.service\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm that the service is active and running.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Configure Auditd Settings<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Auditd configuration file is generally located at:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/audit\/auditd.conf\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open the configuration file:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo nano \/etc\/audit\/auditd.conf\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can configure settings such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>log_file<\/code> \u2014 Specifies the audit log file location.<\/li>\n\n\n\n<li><code>num_logs<\/code> \u2014 Specifies the number of rotated audit log files to retain.<\/li>\n\n\n\n<li><code>max_log_file<\/code> \u2014 Sets the maximum size of an audit log file in megabytes.<\/li>\n\n\n\n<li><code>max_log_file_action<\/code> \u2014 Defines the action to take when the audit log reaches its configured size limit.<\/li>\n\n\n\n<li><code>space_left_action<\/code> \u2014 Specifies an action when available disk space reaches the configured threshold.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Review the existing values and adjust them according to your server&#8217;s storage capacity, audit requirements, and log retention policy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Save the file after making the necessary changes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Configure Audit Rules<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Auditd records events according to the active audit rules. You can inspect the current rules with:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo auditctl -l\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To monitor access to a sensitive file, you can add a temporary watch rule. For example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo auditctl -w \/etc\/passwd -p wa -k identity_changes\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This rule monitors write and attribute-change access to <code>\/etc\/passwd<\/code> and labels matching events with the key <code>identity_changes<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To make custom rules persistent across reboots, configure them in the appropriate audit rules file, commonly:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/audit\/rules.d\/audit.rules\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact persistent rule configuration depends on the distribution and its audit rule-loading mechanism. Validate the rules before applying them on production systems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Review Audit Logs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Audit records are commonly stored in:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/var\/log\/audit\/audit.log\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">View recent entries using:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo tail -n 50 \/var\/log\/audit\/audit.log\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To search for events associated with the rule created earlier, use:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo ausearch -k identity_changes\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Review the output to identify relevant file access and modification events.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Verify the Audit Configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After completing the configuration, check the service status and active audit rules:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl status auditd.service\nsudo auditctl -l\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm that the expected rules are active and that audit events are being recorded.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Auditd service helps Linux administrators monitor security-related events, maintain audit records, and investigate changes to critical system files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By installing and enabling Auditd, configuring log management, creating appropriate audit rules, and reviewing audit records regularly, administrators can improve server visibility and strengthen security monitoring.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, Auditd alone does not make a server secure. It should be used alongside access controls, security updates, firewall configuration, log monitoring, and regular security reviews.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Note:<\/strong> CentOS 7 reached end of life on June 30, 2024. For new deployments, use a currently supported Linux distribution and follow its recommended auditing configuration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What is Auditd in Linux?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Auditd is the userspace component of the Linux Auditing System responsible for recording audit events generated by the kernel and configured audit rules.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why is Auditd important for server security?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It helps administrators track security-relevant events, monitor sensitive files, investigate suspicious activity, and maintain records for security reviews.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Where are Auditd logs stored?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The default audit log location is commonly <code>\/var\/log\/audit\/audit.log<\/code>, although the location can be changed in the Auditd configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How can I check whether Auditd is running?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following command:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl status auditd.service\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Review the output to confirm whether the service is active.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How can I view active audit rules?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo auditctl -l\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This displays the audit rules currently loaded into the running system.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does enabling Auditd automatically monitor every server activity?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. Auditd records events according to the active audit configuration and rules. Administrators must define appropriate rules to capture the events relevant to their security requirements.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can Auditd logs consume significant disk space?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. High-volume audit rules can generate large amounts of data. Configure log rotation, retention, disk-space alerts, and appropriate audit rules to prevent excessive storage consumption.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related Articles<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/modifying-file-timestamps-in-linux-using-touch\/\">Modifying File Timestamps in Linux Using touch<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-the-linux-kernel-handles-network-connections-using-dns-and-routing\/\">How the Linux Kernel Handles Network Connections Using DNS and Routing<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Need Help Securing Your Linux Server?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Need help configuring Linux auditing or strengthening your server security? Our team can assist with Auditd configuration, security monitoring, access control, log management, server hardening, troubleshooting, and ongoing Linux server administration. Get in touch with our team <a href=\"https:\/\/pheonixsolutions.com\/contact?utm_source=chatgpt.com\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Post Date: February 24, 2019Last Updated: October 09, 2026 Introduction The Linux Audit Daemon (auditd) is a key component of [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1022],"tags":[562,563,564,561,260],"class_list":["post-3651","post","type-post","status-publish","format-standard","hentry","category-web-architecture","tag-auditd","tag-auditd-service","tag-enable-auditd","tag-secure","tag-server-hardening","psol-cat-web-architecture"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-WT","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/3651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=3651"}],"version-history":[{"count":1,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/3651\/revisions"}],"predecessor-version":[{"id":12212,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/3651\/revisions\/12212"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=3651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=3651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=3651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}