The Linux audit system allows you to track security-related information about your systems. It allows you to watch security events, filesystem access, network access, commands run by users, and system calls.
By default, audit is installed as part of the core packages. So, there's no need to install this.
Perform these steps to set up the syslog server:
On the
syslogserver, create a/etc/rsyslog.d/audit_server.conffile containing the following:# Receive syslog audit messages via TCP over port 65514 $ModLoad imtcp $InputTCPServerRun 65514 $AllowedSender TCP, 127.0.0.1, 192.168.1.0/24 $template HostAudit, "/var/log/audit/%$YEAR%%$MONTH%%$DAY%-%HOSTNAME%/audit.log" $template auditFormat, "%msg%\n" local6.* ?HostAudit;auditFormat
On the
syslogserver, restartrsyslog, as follows:~]# systemctl restart rsyslogOn the client, create a
/etc/rsyslog.d/audit_client.conffile containing the following:$ModLoad...