What this module does #
auditd is the Linux kernel's auditing subsystem: it records who logs in, who uses sudo, which sensitive files are modified and which system calls are executed. It is the foundation of almost any compliance requirement (CIS, PCI, ISO). The problem is that its native tools — auditctl, ausearch, aureport — have a rough, unfriendly syntax.
The audit module puts a readable layer on top: it tells you at a glance whether auditd is active and with its rules loaded, lists recent events filtering by time or by rule key, gives you a report-style summary (logins, sudo/authentication and file changes) and lets you query the active CIS audit rules — all without having to remember each tool's flags.
auditd rules are usually loaded in immutable mode (locked until the next reboot) so nobody can disable them on the fly. That's why reload will warn you if a change requires a reboot instead of forcing it through.
Common tasks #
Pick what you want to do. Each recipe comes with the command ready to go — copy it, adjust it if needed and hit Copy.
1
Check whether auditing is active
Confirms that auditd is running, with its rules loaded and no backlog.
Connect to your server over SSH as the ubuntu user and run:
$ sudo imaxe audit statusNeed the output for a script or a dashboard? Add --json:
$ sudo imaxe audit status --json2
View recent events
See what has happened, filtering by time or by rule key.
List today's events in a readable summary:
$ sudo imaxe audit events --since todayWant only the events of a specific rule (by its key) and in JSON? Combine --key and --json:
$ sudo imaxe audit events --key identity --jsonausearch. If you don't pass --since, the default window from audit.yml is used.3
Get a summary of the day
An aureport-style report: logins, sudo/auth and file changes.
Ask for the aggregated activity summary:
$ sudo imaxe audit summarysudo and file modifications have been recorded.4
View or reload the rules
Query the active rules and apply changes while respecting immutable mode.
List the audit rules loaded right now (equivalent to auditctl -l):
$ sudo imaxe audit rules listIf you have edited the rule files, reload them. If the system is in immutable mode, the command will warn you that a reboot is required:
$ sudo imaxe audit rules list --json
$ sudo imaxe audit reloadIf events comes up empty, first check with status that auditd is active and has its rules loaded. Perhaps the --since window is too short, or no rule uses the key you're filtering by. Check the rules with rules list.
Synopsis #
imaxe audit <subcomando> [<subcomando anidado>] [--since T] [--key K] [--json]Every subcommand reads from the auditing subsystem, which is only accessible as root (use sudo). Add --json to status, events or rules list for machine-readable output, suitable for scripting and dashboards.
Subcommands #
| Subcommand | What it does | Relevant flags |
|---|---|---|
| status | Status: auditd active, rules loaded, immutable mode and backlog. | --json |
| events | Lists recent, filterable events in a readable summary. | --since, --key, --json |
| summary | aureport-style summary: logins, sudo/auth and file changes. | — |
| rules | Management group for the audit rules. Requires a nested subcommand. | — |
| rules list | Lists the active rules (equivalent to auditctl -l). | --json |
| reload | Reloads the rules; respects immutable mode and warns if a reboot is required. | — |
Arguments and flags #
| Flag | Type | Default | Description |
|---|---|---|---|
| --since | string | audit.yml | In events: from when to list (e.g. today, recent, 'now-1 hour'). If omitted, default_since from audit.yml is used. |
| --key | string | — | In events: filters by the key of an auditd rule (e.g. identity). |
| --json | bool | false | In status, events and rules list: emits the result as structured JSON on stdout. |
summary, rules and reload take no flags: they run as-is. Remember that rules always needs the nested subcommand list.
Files and paths #
| Path | Contents |
|---|---|
| /etc/imaxe/audit.yml | Module configuration: default window for events (default_since) and other options. |
| /etc/audit/audit.rules | Audit rules loaded at boot by auditd (CIS baseline). |
| /etc/audit/rules.d/ | Rule fragments that are assembled into the final set. |
| /var/log/audit/audit.log | Event log that auditd writes and that events/summary read. |
Example audit.yml:
events:
default_since: todayExit codes and logs #
Each run returns a code you can check with echo $? — handy for chaining in scripts:
Follow the log live while you troubleshoot:
$ sudo journalctl -u auditd -f
$ sudo tail -f /var/log/audit/audit.logTroubleshooting #
| Symptom | Likely cause | Fix |
|---|---|---|
| You get AUDITD (code 3) | The auditd service is not running. | Start it with systemctl start auditd and repeat imaxe audit status. |
events returns nothing | --since window too short or nonexistent key. | Widen --since (e.g. 'now-1 hour') or check the keys with rules list. |
reload warns about a reboot | The rules are in immutable mode (locked until reboot). | Schedule a reboot to apply the changes; until then the previous rules remain in effect. |
| You get USAGE (code 2) | rules was called without the nested subcommand. | Use imaxe audit rules list: rules always requires a subcommand. |
Stuck with the Audit module?
Write to us with the output of «imaxe <module> status --json» and we'll get back to you fast.