1AUDITD.CONF:(5) System Administration Utilities AUDITD.CONF:(5)
2
6 auditd.conf - audit daemon configuration file
7
9 The file /etc/audit/auditd.conf contains configuration information spe‐
10 cific to the audit daemon. Each line should contain one configuration
11 keyword, an equal sign, and then followed by appropriate configuration
12 information. All option names and values are case insensitive. The key‐
13 words recognized are listed and described below. Each line should be
14 limited to 160 characters or the line will be skipped. You may add com‐
15 ments to the file by starting the line with a '#' character.
16 local_events
19 This yes/no keyword specifies whether or not to include local
20 events. Normally you want local events so the default value is
21 yes. Cases where you would set this to no is when you want to
22 aggregate events only from the network. At the moment, this is
23 useful if the audit daemon is running in a container. This
24 option can only be set once at daemon start up. Reloading the
25 config file has no effect.
26 log_file
28 This keyword specifies the full path name to the log file where
29 audit records will be stored. It must be a regular file.
30 write_logs
32 This yes/no keyword determines whether or not to write logs to
33 the disk. Normally you want this so the default is yes.
34 log_format
36 The log format describes how the information should be stored on
37 disk. There are 2 options: raw and enriched. If set to RAW, the
38 audit records will be stored in a format exactly as the kernel
39 sends it. The ENRICHED option will resolve all uid, gid,
40 syscall, architecture, and socket address information before
41 writing the event to disk. This aids in making sense of events
42 created on one system but reported/analyzed on another system.
43 The NOLOG option is now deprecated. If you were setting this
44 format, now you should set the write_logs option to no.
45 log_group
47 This keyword specifies the group that is applied to the log
48 file's permissions. The default is root. The group name can be
49 either numeric or spelled out.
50 priority_boost
52 This is a non-negative number that tells the audit daemon how
53 much of a priority boost it should take. The default is 4. No
54 change is 0.
55 flush Valid values are none, incremental, incremental_async, data,
57 and sync. If set to none, no special effort is made to flush
58 the audit records to disk. If set to incremental, Then the freq
59 parameter is used to determine how often an explicit flush to
60 disk is issued. The incremental_async parameter is very much
61 like incremental except the flushing is done asynchronously for
62 higher performance. The data parameter tells the audit daemon to
63 keep the data portion of the disk file sync'd at all times. The