In this section, we will see how to use auditd, for the purpose of auditing:
- If the tool is not already installed on our Linux distribution, we can install it by running the following command:
apt-get install auditd
- When the package is installed, it also installs a few other tools as part of the installation process. One of the tools installed is auditctl which helps in controlling the behavior of the software and also in adding rules.
- We can check the version of the tool by running the following command:

- When auditd is installed for the first time, it does not have any rules available yet. This can be checked by running ...