主题： auditd

• The Linux audit framework: writing auditd rules, watching files, and reading the results back

  auditd rules live in /etc/audit/rules.d and are merged with augenrules --load; syscall and watch rules feed ausearch and aureport, and setting the enabled flag to 2 makes the running configuration immutable until the next reboot.

  methodology · en · reviewed · 知识截至 2026-09-24

机器可读： JSON