tldr/pages/common/auditd.md

269 B

auditd

This responds to requests from the audit utility and notifications from the kernel. It should not be invoked manually.

  • Start the daemon:

auditd

  • Start the daemon in debug mode:

auditd -d

  • Start the daemon on-demand from launchd:

auditd -l