System auditing is a very important task that should be a part of every server. It allows us to audit minute details related to what exactly is happening within the system.
In the previous section, we discussed auditing the user commands with the help of PAM, but to gain mindful insights, we need to audit a lot of other things as well, such as critical file getting changed, file removal, and unexpected time change in the production server.
Most system administrators might be aware of basic auditing functionalities such as looking into /var/log/secure file for login attempts, but when it comes to low-level auditing, this is where the work needs to be done.
Let's look into some of the use cases that will help us understand why system-level auditing is required, where typically the traditional log file fails to help:
- Watching for file access: We...