Linux audit – Log files in /var/log/audit

Linux audit – Log files /var/log/audit

By default the Linux audit framework logs all data in the /var/log/audit directory. Usually this file is named audit.log.


This is the default log file for the Linux audit daemon. The file has a capture of all related audit events. It has been configured in auditd.conf:

root@server# cat /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log


Usually there is no reason to alter this location, unless a different storage location is preferred. For safeguarding of the data, it’s also wise to monitor this file and duplicate data to a locate storage location (e.g. with remote syslog).


Although the log file is logged in plain ASCII format, it is better suited for parsing with specific tools in the audit framework.


This utility helps with searching specific events, for example during the last day and with a specific type. Another possibility is filtering on a defined column, like a file name. In this case the file name should match the requested name.


While searching for data has its purpose, reporting is a second useful goal. The aureport utility comes in handy and extracts all data from the file. It will then present the system administrator or auditor with the related information. This information varies from configuration changes (to the audit daemon) up to the amount of failed system calls (syscalls).

Summary Report
Range of time in logs: 12/07/2013 03:30:01.190 – 04/18/2014 15:00:01.378
Selected time for report: 12/07/2013 03:30:01 – 04/18/2014 15:00:01.378
Number of changes in configuration: 425
Number of changes to accounts, groups, or roles: 0
Number of logins: 0
Number of failed logins: 0
Number of authentications: 0
Number of failed authentications: 0
Number of users: 5
Number of terminals: 10
Number of host names: 0
Number of executables: 32
Number of files: 223
Number of AVC’s: 0
Number of MAC events: 0
Number of failed syscalls: 4190
Number of anomaly events: 3
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of keys: 3
Number of process IDs: 31405
Number of events: 116468

The example above shows clearly how broad the events can be to be monitored. Proper configuration and safeguarding of the audit.log file will be necessary to protect this valuable information!

One more thing...

Keep learning

So you are interested in Linux security? Join the Linux Security Expert training program, a practical and lab-based training ground. For those who want to become (or stay) a Linux security expert.

See training package

Lynis Enterprise screenshot to help with system hardeningSecurity scanning with Lynis and Lynis Enterprise

Run automated security scans and increase your defenses. Lynis is an open source security tool to perform in-depth audits. It helps with system hardening, vulnerability discovery, and compliance.