2 entries
Linux auditd
Kernel-level audit records, and how to read a multi-line audit event.
- EXECVE auditd EXECVE: a command was executed Informational The Linux audit framework recorded a program being run, with every argument. Unlike sudo logging it works at the kernel level, so it keeps recording after someone obtains a root shell — which is precisely where sudo's audit trail ends.
- USER_AUTH auditd USER_AUTH: an authentication attempt was recorded Worth a look The audit framework recorded an authentication attempt and its result. It covers the same ground as the syslog authentication messages but in a structured, harder-to-tamper-with form, which is why compliance regimes ask for it specifically.