auditctl(8)
Configure and manage the Linux audit daemon to log system calls and file access for security monitoring.
Synopsis
auditctl [OPTION]... [RULE]...Description
auditctl is the primary tool for configuring the Linux audit framework (auditd). It allows administrators to define rules that monitor system calls, file access, and other security-relevant events. Rules are loaded into the kernel and persist until the audit daemon is restarted or rules are explicitly removed.
Rules can target specific syscalls, files, directories, or attributes. Audit logs are written to /var/log/audit/audit.log and can be analyzed with ausearch and aureport.
Changes made with auditctl are temporary by default; for persistent rules across reboots, add them to /etc/audit/rules.d/audit.rules.
Common options
| Flag | What it does |
|---|---|
-a action,filter | Add a rule; action is always or never, filter is task/entry/exit/user-defined |
-d | Delete all rules and reset audit to disabled state |
-D | Delete all rules (same as -d but leaves audit enabled) |
-w path -p permissions | Watch a file or directory; permissions are r(read), w(write), x(execute), a(attribute) |
-S syscall | Specify which syscall(s) to audit; can be used multiple times |
-F field=value | Filter rule by field (e.g., uid=0, comm=bash, arch=b64) |
-k keyname | Assign a label/key to the rule for easier log searching and filtering |
-l | List all currently loaded audit rules |
-m text | Send a message to the audit log |
-b backlog_limit | Set kernel audit buffer size (number of messages) |
-f failure_mode | Set failure handling: 0=silent, 1=printk, 2=panic |
-e status | Set audit status: 0=disabled, 1=enabled, 2=immutable/locked |
Examples
List all currently active audit rules
auditctl -lMonitor /etc/passwd for writes and attribute changes, tagged as 'passwd_changes'
auditctl -w /etc/passwd -p wa -k passwd_changesAudit all execve syscalls from user 1000 on 64-bit systems
auditctl -a always,exit -F arch=b64 -S execve -F uid=1000 -k user_commandsWatch /tmp directory for all operations (read, write, execute, attribute changes)
auditctl -w /tmp/ -p rwxa -k tmp_monitoringAudit all file opens in /var/log directory
auditctl -a always,exit -F arch=b64 -S open,openat -F dir=/var/log -k log_accessDelete all rules and disable the audit subsystem
auditctl -dWrite a message to the audit log
auditctl -m 'Audit rules reloaded at system startup'Make audit configuration immutable (requires reboot to change)
auditctl -e 2