> For the complete documentation index, see [llms.txt](https://linux-tutorial-cli.gitbook.io/linux-cli-tutorial/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://linux-tutorial-cli.gitbook.io/linux-cli-tutorial/txt-files/file-systems-cocepts/lpic3-303/auditctl.md).

# auditctl

`auditctl` is a command-line utility used to interact with the Linux Audit Framework, specifically for managing audit rules. It allows administrators to dynamically add, delete, and list audit rules without needing to manually edit the audit configuration files (`/etc/audit/audit.rules`). Here’s an overview of `auditctl` and its usage:

### Overview of `auditctl`

#### Purpose

The main purpose of `auditctl` is to control the behavior of the Linux Audit Framework by:

* Adding new audit rules to monitor specific system events, files, directories, and processes.
* Modifying existing audit rules to adjust monitoring criteria.
* Deleting audit rules to stop monitoring specific events.

### Basic Usage

#### Viewing Current Audit Rules

To view the current audit rules that are active, you can use `auditctl` with the `-l` option:

```bash
auditctl -l
```

This command lists all currently active audit rules.

#### Adding Audit Rules

To add new audit rules, use `auditctl` with the `-a` option followed by the rule specifications. For example, to monitor changes to the `/etc/passwd` file:

```bash
auditctl -a always,exit -F path=/etc/passwd -F perm=wa -k passwd_changes
```

* `-a`: Adds a new rule.
* `always,exit`: Specifies the conditions under which the rule triggers (always on exit).
* `-F`: Defines filter fields (in this case, path and permissions).
* `-k`: Assigns a unique key to the audit rule for identification in logs.

#### Deleting Audit Rules

To delete existing audit rules, use `auditctl` with the `-D` option followed by the rule specifications or keys:

```bash
auditctl -D
```

This command deletes all currently loaded audit rules.

#### Example Use Cases

1. **Monitoring File Access**:

   ```bash
   auditctl -a always,exit -F path=/etc/shadow -F perm=r -k shadow_access
   ```

   This rule monitors read access to the `/etc/shadow` file.
2. **Monitoring Process Execution**:

   ```bash
   auditctl -a always,exit -F arch=b64 -S execve -k process_execution
   ```

   This rule monitors execution of processes on a 64-bit architecture.
3. **Monitoring Socket Operations**:

   ```bash
   auditctl -a always,exit -F arch=b64 -S socket -k socket_operations
   ```

   This rule monitors socket operations on a 64-bit architecture.

### Advanced Usage

* **Rule Fields**: Use various filter fields (`-F`) such as `uid`, `auid`, `syscall`, `path`, `success`, `key`, etc., to specify conditions for audit rules.
* **Persistent Rules**: To make rules persistent across system reboots, add them to `/etc/audit/audit.rules` and reload the audit configuration (`sudo systemctl reload auditd`).

### Security Considerations

* **Rule Management**: Regularly review and manage audit rules to ensure they align with security policies and operational needs.
* **Performance Impact**: Consider the performance impact of auditing high-volume events and adjust rules accordingly.

### Conclusion

`auditctl` is a powerful command-line tool for managing audit rules within the Linux Audit Framework. By dynamically adding, modifying, or deleting audit rules, administrators can tailor system monitoring to meet security requirements, detect unauthorized activities, and ensure compliance with organizational policies.