Security
auditd
Security Auditing - Linux Auditing Framework for security events.
Ubuntu
Debian
Fedora
CentOS
RHEL
SUSE
Verified: 2026-05-10
Syntax
$auditctl [OPTIONS]
Examples
$auditctl -w /etc/passwd -p wa -k passwd_mod
$auditctl -l
Typical use cases
?
Standard usage
auditd --help
Note
Monitors system calls and file access. Rules defined in /etc/audit/audit.rules.
Export