You can add custom audit rules using the command line tool auditctl . By default, rules will be added to the bottom of the current list, but could be inserted at the top too. To make your rules permanent, you need to add them to the file /etc/audit/rules. d/audit.

How do you set audit rules in Linux?

Audit rules can be set:

1. on the command line using the auditctl utility. Note that these rules are not persistent across reboots. For details, see Section 6.5. 1, “Defining Audit Rules with auditctl”
2. in the /etc/audit/audit. rules file. For details, see Section 6.5.

How do I enable audit logs in Linux?

Solution

1. Login to the linux box and assume root. …
2. Edit /etc/profile and add the following lines to the bottom of the file: …
3. Save and exit /etc/profile.
4. Edit /etc/rsyslog.conf and add the following lines to the bottom of the file: …
5. Save and exit /etc/rsyslog.conf.

22 авг. 2018 г.