--- title: "P21: Audit Logging and Monitoring Depth" canonical: https://openvapt.com/academy/p21.html html: https://openvapt.com/academy/p21.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P21: Audit Logging and Monitoring Depth What the Linux audit daemon should record, how its rules and log files are protected, and why a copy of every log must leave the machine. - Level: Practitioner - Time: about 30 minutes - Read first: P16 ## You Will Be Able To - Explain the difference between a running audit daemon and a useful audit trail. - Read an audit rule file and say which events it records (identity files, logins, time changes, kernel modules, privileged commands). - Explain why the immutable flag, log file permissions and full-disk actions protect the evidence an investigation depends on. - Explain why journald persistence, compression and remote forwarding matter. ## From Running to Recording HOST-LOG-002 asks whether auditd is active. That is the first question, not the last: an audit daemon with no rules records almost nothing, and one started by hand stops at the next reboot (HOST-AUD-001). NIST SP 800-92 describes log management as deciding what to record, protecting what was recorded and reviewing it. The HOST-AUD checks follow that order. Audit rules live in /etc/audit/rules.d and are loaded at boot. A watch rule (-w /etc/passwd -p wa) records every write to a file with the user, process and time. A system call rule (-a always,exit -S settimeofday) records every use of a kernel call. Together they turn a handful of files and calls into an audit trail. ## What to Record Identity files (HOST-AUD-002): /etc/passwd, group, shadow, gshadow and the sudoers files are how an intruder adds an account or grants themselves privilege. Login records (HOST-AUD-003): lastlog, the failed-login store, wtmp and btmp are what investigators read first and intruders clean first. Time changes (HOST-AUD-004): moving the clock forges timestamps and confuses every timeline. Kernel modules (HOST-AUD-005): a rootkit is usually a module. Privileged commands (HOST-AUD-006): setuid programs such as sudo, su and passwd are where ordinary users become root. The rule for each of these is a few lines. The checks map them to NIST SP 800-53 AU-2 (event logging) and AU-12 (audit record generation) and to CIS Controls v8 safeguards 8.2 and 8.5, by number only. ## Protecting the Evidence Whoever gains root can delete the rules (auditctl -D) unless the rule set ends with -e 2, which locks it until reboot (HOST-AUD-007). The audit log directory and files hold command lines, file names and sometimes secrets, so they must be root-only (HOST-AUD-008). And auditd must be told what to do when the disk fills: with max_log_file_action set to ignore or suspend an attacker switches auditing off by filling the disk (HOST-AUD-009). NIST SP 800-53 calls this AU-9, protection of audit information, and AU-5, response to logging failures. ## journald and Remote Copies systemd-journald keeps the journal in memory unless Storage=persistent (or auto with /var/log/journal present); a reboot or a crash then erases it. Compression keeps a persistent journal small enough to retain for weeks (HOST-AUD-010). Every local log can be edited by root. A copy that already left the machine, through rsyslog forwarding, syslog-ng or systemd-journal-upload, is the record an investigation can trust (HOST-AUD-011). Forward over TLS so the logs are not readable in transit. This is AU-9(2), storing audit records on a separate system, and CIS Controls v8 safeguard 8.9. ## In Summary Running auditd is not the same as recording. Load rules for identity files, logins, time changes, modules and privileged commands, and lock the configuration. Protect the log directory and make the daemon act when the disk fills. Keep the journal persistent and send a copy somewhere an attacker cannot reach. ## Apply It - [HOST-AUD-001 Audit Daemon Not Enabled at Boot](https://openvapt.com/checks/HOST-AUD-001.md) (low) - [HOST-AUD-002 Identity Files Not Audited](https://openvapt.com/checks/HOST-AUD-002.md) (low) - [HOST-AUD-003 Login and Logout Events Not Audited](https://openvapt.com/checks/HOST-AUD-003.md) (low) - [HOST-AUD-004 System Time Changes Not Audited](https://openvapt.com/checks/HOST-AUD-004.md) (low) - [HOST-AUD-005 Kernel Module Loading Not Audited](https://openvapt.com/checks/HOST-AUD-005.md) (low) - [HOST-AUD-006 Privileged Command Use Not Audited](https://openvapt.com/checks/HOST-AUD-006.md) (low) - [HOST-AUD-007 Audit Configuration Not Immutable](https://openvapt.com/checks/HOST-AUD-007.md) (low) - [HOST-AUD-008 Audit Log Files Readable by Others](https://openvapt.com/checks/HOST-AUD-008.md) (low) - [HOST-AUD-009 Audit Daemon Ignores a Full Log Disk](https://openvapt.com/checks/HOST-AUD-009.md) (low) - [HOST-AUD-010 Journal Not Persistent or Not Compressed](https://openvapt.com/checks/HOST-AUD-010.md) (low) - [HOST-AUD-011 Logs Not Forwarded to a Remote Collector](https://openvapt.com/checks/HOST-AUD-011.md) (low) ## Lab 1. `Run: openvapt demo --only HOST-AUD- --out p21` 2. `Open internal/lab/fixtures_audit_pam_pkg.go and compare the vulnerable audit.rules (four housekeeping lines) with the hardened 50-lab.rules. For each failed HOST-AUD check, find the rule line that makes it pass.` 3. `Write one audit rule of your own for a file you care about (for example /etc/ssh/sshd_config) and explain which HOST-AUD check would notice its absence.` 4. `On a test machine you own: sudo openvapt scan --only HOST-AUD- and read auditctl -l alongside the report.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. auditd is active but /etc/audit/rules.d contains only -D and -b 8192. What is being recorded? - A. Every file change on the system - B. Almost nothing: there are no watch or system call rules - C. Only failed logins - D. Only kernel messages - Answer: B. Those lines clear the rules and set a buffer size. Without -w or -a rules, there is no audit trail. 2. What does -e 2 at the end of the audit rules do? - A. Enables two audit log files - B. Locks the rules until the next reboot so root cannot remove them - C. Sets the log level to 2 - D. Turns auditing off - Answer: B. The immutable flag means the only way to change the rules is a reboot, which is itself a logged event. 3. Why forward logs to another machine when the local disk has plenty of space? - A. To save disk space - B. Because an intruder with root can edit or delete the local copy - C. Because journald cannot write to disk - D. Because remote logs are faster to search - Answer: B. A copy that already left the machine is the one an investigation can trust. 4. journald.conf has Storage=volatile. What happens to the journal at reboot? - A. It is compressed - B. It is kept in /var/log/journal - C. It is lost: volatile means memory only - D. It is forwarded to another machine - Answer: C. Set Storage=persistent (and create /var/log/journal) so the journal survives. 5. Which events should the audit rules record? - A. Changes to identity files, logins, time changes, kernel modules and privileged commands - B. Only web server requests - C. Only failed SSH logins - D. Every keystroke of every user - Answer: A. These are the events an investigation needs to show who changed what and when. ## Key Terms - Audit Rule: One line in the Linux audit configuration that tells the kernel which file writes or system calls to record, with the user, process and time attached. - Audit Trail: The ordered record of security-relevant events (logins, privilege use, changes to key files) that lets an investigator reconstruct what happened and who did it. - Immutable Audit Configuration: The -e 2 flag at the end of the audit rules, which locks them until the next reboot so that even root cannot switch auditing off quietly. - Log Forwarding: Sending a copy of log messages to another machine as they are written, so an intruder who edits the local logs does not reach the only copy. - Persistent Journal: A systemd journal stored on disk (Storage=persistent, under /var/log/journal) rather than only in memory, so it survives a reboot. ## References - [NIST SP 800-92, Guide to Computer Security Log Management](https://csrc.nist.gov/pubs/sp/800/92/final) - [NIST SP 800-53 Rev. 5, AU family (Audit and Accountability)](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) - [auditctl(8), Linux man-pages](https://man7.org/linux/man-pages/man8/auditctl.8.html) - [journald.conf(5), systemd](https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html) Offline: `openvapt learn P21`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p21.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.