Mastering Linux Security and Hardening - Second Edition

Creating audit rules

Okay, let's start with something simple and work our way up to something awesome. First, let's check to see whether any audit rules are in effect:

[donnie@localhost ~]$ sudo auditctl -l[sudo] password for donnie:No rules[donnie@localhost ~]$

As you can see, the auditctl command is what we use to manage audit rules. The -l option lists the rules.