Lion Cipher Lab
Configure Linux auditing with auditd
- Cyber / Security Engineer
- Intermediate
- ~50 min
- Free · no account required
Why it matters
When something goes wrong on a Linux host, the first question is always the same: what actually happened? auditd is the answer most incident responders reach for, because it records the events a normal system log never captures — which process called which syscall, who touched a sensitive file, what got executed and by whom. Without it, a machine forgets; with it, you can reconstruct the story. The skill that transfers everywhere is not the syntax but the loop: decide what matters, tell the kernel to record exactly that, prove it fires, and read it back. And the reality underneath it is just…
What you'll learn
- Linux audit system (auditd)
- writing audit rules (-w file watches, -a syscall rules)
- keying and finding events
- reading logs with ausearch
- summarizing with aureport
- adopting a baseline ruleset
- tuning audit noise and shipping logs off-host
Steps in this lab
- What auditd records, and why IR leans on it
- Install and enable auditd
- Watch a sensitive file with -w, and key it
- Log a syscall with -a, and key it
- Trigger the events, then read them with ausearch
- See the shape of it with aureport
- Adopt a baseline ruleset, make it persist, and tune the noise
- What you built, and the habit underneath it