tldr/pages/linux/auditctl.md

676 B

auditctl

Utility to control the behavior, get status and manage rules of the Linux Auditing System. More information: https://manned.org/auditctl.

  • Display the [s]tatus of the audit system:

sudo auditctl -s

  • [l]ist all currently loaded audit rules:

sudo auditctl -l

  • [D]elete all audit rules:

sudo auditctl -D

  • [e]nable/disable the audit system:

sudo auditctl -e {{1|0}}

  • Watch a file for changes:

sudo auditctl -a always,exit -F arch=b64 -F path={{/path/to/file}} -F perm=wa

  • Recursively watch a directory for changes:

sudo auditctl -a always,exit -F arch=b64 -F dir={{/path/to/directory/}} -F perm=wa

  • Display [h]elp:

auditctl -h