Audit Logging and Monitoring Depth

From Running to Recording

HOST-LOG-002 asks whether auditd is active. That is the first question, not the last: an audit daemon with no rules records almost nothing, and one started by hand stops at the next reboot (HOST-AUD-001). NIST SP 800-92 describes log management as deciding what to record, protecting what was recorded and reviewing it. The HOST-AUD checks follow that order.

Audit rules live in /etc/audit/rules.d and are loaded at boot. A watch rule (-w /etc/passwd -p wa) records every write to a file with the user, process and time. A system call rule (-a always,exit -S settimeofday) records every use of a kernel call. Together they turn a handful of files and calls into an audit trail.

What to Record

Identity files (HOST-AUD-002): /etc/passwd, group, shadow, gshadow and the sudoers files are how an intruder adds an account or grants themselves privilege. Login records (HOST-AUD-003): lastlog, the failed-login store, wtmp and btmp are what investigators read first and intruders clean first. Time changes (HOST-AUD-004): moving the clock forges timestamps and confuses every timeline. Kernel modules (HOST-AUD-005): a rootkit is usually a module. Privileged commands (HOST-AUD-006): setuid programs such as sudo, su and passwd are where ordinary users become root.

The rule for each of these is a few lines. The checks map them to NIST SP 800-53 AU-2 (event logging) and AU-12 (audit record generation) and to CIS Controls v8 safeguards 8.2 and 8.5, by number only.

Protecting the Evidence

Whoever gains root can delete the rules (auditctl -D) unless the rule set ends with -e 2, which locks it until reboot (HOST-AUD-007). The audit log directory and files hold command lines, file names and sometimes secrets, so they must be root-only (HOST-AUD-008). And auditd must be told what to do when the disk fills: with max_log_file_action set to ignore or suspend an attacker switches auditing off by filling the disk (HOST-AUD-009). NIST SP 800-53 calls this AU-9, protection of audit information, and AU-5, response to logging failures.

journald and Remote Copies

systemd-journald keeps the journal in memory unless Storage=persistent (or auto with /var/log/journal present); a reboot or a crash then erases it. Compression keeps a persistent journal small enough to retain for weeks (HOST-AUD-010).

Every local log can be edited by root. A copy that already left the machine, through rsyslog forwarding, syslog-ng or systemd-journal-upload, is the record an investigation can trust (HOST-AUD-011). Forward over TLS so the logs are not readable in transit. This is AU-9(2), storing audit records on a separate system, and CIS Controls v8 safeguard 8.9.

In Summary

Running auditd is not the same as recording. Load rules for identity files, logins, time changes, modules and privileged commands, and lock the configuration. Protect the log directory and make the daemon act when the disk fills. Keep the journal persistent and send a copy somewhere an attacker cannot reach.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only HOST-AUD- --out p21
2. Open internal/lab/fixtures_audit_pam_pkg.go and compare the vulnerable audit.rules (four housekeeping lines) with the hardened 50-lab.rules. For each failed HOST-AUD check, find the rule line that makes it pass.
3. Write one audit rule of your own for a file you care about (for example /etc/ssh/sshd_config) and explain which HOST-AUD check would notice its absence.
4. On a test machine you own: sudo openvapt scan --only HOST-AUD- and read auditctl -l alongside the report.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-92, Guide to Computer Security Log Management
• NIST SP 800-53 Rev. 5, AU family (Audit and Accountability)
• auditctl(8), Linux man-pages
• journald.conf(5), systemd

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P21: Audit Logging and Monitoring Depth (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p21.html

@misc{openvapt_p21,
  author       = {{OpenVAPT}},
  title        = {{P21: Audit Logging and Monitoring Depth}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p21.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}