The Linux audit framework: writing auditd rules, watching files, and reading the results back

Goal

Add persistent audit rules that watch a sensitive file and record relevant system calls, load them without a reboot, and read the resulting events back with ausearch and aureport.

Prerequisites

Root privileges; the audit package (auditd, auditctl, augenrules, ausearch, aureport installed); the auditd service running. auditd is "the userspace component to the Linux Auditing System" and writes the records to disk.

Steps

1. Add a rule file under the rules directory rather than editing a single monolithic file: /etc/audit/rules.d/50-etc-watch.rules containing -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F key=identity-files (add a second line with arch=b32 on hosts that run 32-bit programs). perm=wa matches writes and attribute changes, and the key tags matching events for later lookup. The older -w /etc/passwd -p wa -k identity-files form still loads, but the current auditctl man page states that the -w form "is for backwards compatibility and is deprecated due to poor system performance" and says to convert such watches to the syscall-based form.
2. Merge all files under /etc/audit/rules.d (only files ending in .rules) into /etc/audit/audit.rules and load them: augenrules --load. augenrules "merges all component audit rules files, found in the audit rules directory, /etc/audit/rules.d"; augenrules --check reports whether a merge is pending without writing anything.
3. Confirm the rule is active: auditctl -l should list it. If it is listed but never matches, look for an -a never,task rule in that output: the man page notes that many systems install one by default (a 10-no-audit.rules file) so that processes skip rule evaluation.
4. Trigger a matching event with a harmless change (e.g. sudo touch /etc/passwd, which only updates timestamps) and search for it by key: ausearch -k identity-files -ts recent (recent means the last 10 minutes). ausearch documents -k/--key as searching "for an event based on the given key string."
5. Get an aggregate view instead of individual records: aureport -k for a key-based summary, or plain aureport, which "produces summary reports of the audit system logs."
6. To lock the configuration against further changes for the rest of the boot, put -e 2 in its own file (e.g. 99-finalize.rules); augenrules always emits the last -e directive as the last line of the merged file. auditctl documents that in this mode "any attempt to change the configuration in this mode will be audited and denied" and that the configuration "can only be changed by rebooting the machine" — plan this for the end of a maintenance window, not the start.

Expected result

ausearch -k identity-files returns the triggered event with full syscall context; aureport shows it in the relevant summary; after -e 2, a further auditctl load attempt fails and is itself logged.

Limits and test basis

-e 2 requires a reboot to undo, and because the line sits in /etc/audit/rules.d it is loaded again at every boot: to undo it, remove the file, run augenrules to regenerate audit.rules, then reboot. Never load it before confirming the rest of the rule set is correct. Removing a rule file and re-running augenrules --load (without -e 2 active) is the way to undo an unwanted rule; keep a copy of the previous /etc/audit/rules.d contents before editing. Rules loaded this way persist across reboots; rules added only with auditctl -a do not.