OpenVAPTFor Teachers · Back to the Module · Print with your browser's Print command.
P21 Worksheet: Audit Logging and Monitoring Depth
Student Worksheet (about 30 minutes, Practitioner level)
Name: ______________________ Class: __________ Date: __________
Read first: P16
Learning Objectives
- [ ] Explain the difference between a running audit daemon and a useful audit trail.
- [ ] Read an audit rule file and say which events it records (identity files, logins, time changes, kernel modules, privileged commands).
- [ ] Explain why the immutable flag, log file permissions and full-disk actions protect the evidence an investigation depends on.
- [ ] Explain why journald persistence, compression and remote forwarding matter.
Key Terms
Write each definition in your own words.
- Audit Rule: ______________________________________________
- Audit Trail: ______________________________________________
- Immutable Audit Configuration: ______________________________________________
- Log Forwarding: ______________________________________________
- Persistent Journal: ______________________________________________
Lab Tasks
Use only the simulated lab or a machine your teacher has authorised.
- Run: openvapt demo --only HOST-AUD- --out p21
- Open internal/lab/fixtures_audit_pam_pkg.go and compare the vulnerable audit.rules (four housekeeping lines) with the hardened 50-lab.rules. For each failed HOST-AUD check, find the rule line that makes it pass.
- Write one audit rule of your own for a file you care about (for example /etc/ssh/sshd_config) and explain which HOST-AUD check would notice its absence.
- On a test machine you own: sudo openvapt scan --only HOST-AUD- and read auditctl -l alongside the report.
Self-Check Questions
- auditd is active but /etc/audit/rules.d contains only -D and -b 8192. What is being recorded?
- [ ] a) Every file change on the system
- [ ] b) Almost nothing: there are no watch or system call rules
- [ ] c) Only failed logins
- [ ] d) Only kernel messages
- What does -e 2 at the end of the audit rules do?
- [ ] a) Enables two audit log files
- [ ] b) Locks the rules until the next reboot so root cannot remove them
- [ ] c) Sets the log level to 2
- [ ] d) Turns auditing off
- Why forward logs to another machine when the local disk has plenty of space?
- [ ] a) To save disk space
- [ ] b) Because an intruder with root can edit or delete the local copy
- [ ] c) Because journald cannot write to disk
- [ ] d) Because remote logs are faster to search
- journald.conf has Storage=volatile. What happens to the journal at reboot?
- [ ] a) It is compressed
- [ ] b) It is kept in /var/log/journal
- [ ] c) It is lost: volatile means memory only
- [ ] d) It is forwarded to another machine
- Which events should the audit rules record?
- [ ] a) Changes to identity files, logins, time changes, kernel modules and privileged commands
- [ ] b) Only web server requests
- [ ] c) Only failed SSH logins
- [ ] d) Every keystroke of every user
Reflection
Which finding from this module would matter most on a server you are responsible for, and why?
________________________________________________________________
Sources
- NIST SP 800-92, Guide to Computer Security Log Management: https://csrc.nist.gov/pubs/sp/800/92/final
- NIST SP 800-53 Rev. 5, AU family (Audit and Accountability): https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- auditctl(8), Linux man-pages: https://man7.org/linux/man-pages/man8/auditctl.8.html
- journald.conf(5), systemd: https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.