How to Audit Linux Server Security Events Using Auditd Rules, Ausearch, and Aureport on Ubuntu

ByAkensai

Learning how to audit Linux server security events using Auditd rules, Ausearch, and Aureport on Ubuntu is one of the most valuable skills a server administrator can have. Security breaches often go undetected for days or weeks. A proper audit trail changes that. The Linux Audit framework gives you a detailed record of every significant event on your system. You can track file access, user logins, privilege escalation, and system calls. This tutorial walks you through installing Auditd, writing custom rules, and querying your logs with Ausearch and Aureport. By the end, you’ll have a working audit system that helps you catch suspicious activity fast. Whether you manage a single VPS or a fleet of production servers, this guide will help you build a solid security monitoring foundation.

Prerequisites and Requirements for Auditing Linux Server Security

Before you start, make sure you have the following in place.

System requirements:

  • Ubuntu 20.04 or 22.04 LTS (these steps also work on Ubuntu 24.04)
  • Root or sudo access to the server
  • A basic understanding of the Linux command line
  • An active SSH connection or direct terminal access

Estimated time: 30–45 minutes

You don’t need prior experience with audit frameworks. However, you should be comfortable running commands as root and editing configuration files. All commands in this tutorial are tested on a fresh Ubuntu 22.04 installation. You’ll also want a text editor available. Nano works fine for this guide.

Step-by-Step Guide to Audit Linux Server Security Events Using Auditd

Related tutorial: How to Set Up a WireGuard VPN Server on Ubuntu Linux

Step 1: Update your system packages

Always start with a fresh package index. This prevents version conflicts during installation.

sudo apt update && sudo apt upgrade -y

Step 2: Install the Auditd package

Auditd is available in Ubuntu’s default repositories. Install it along with the audispd plugins for extended functionality.

sudo apt install auditd audispd-plugins -y

Once installed, the service starts automatically. Verify it’s running with:

sudo systemctl status auditd

You should see active (running) in the output. If not, start it manually with sudo systemctl start auditd.

Step 3: Enable Auditd to start on boot

Make sure the audit daemon persists across reboots.

sudo systemctl enable auditd

Step 4: Understand the Auditd configuration file

The main configuration file lives at /etc/audit/auditd.conf. Open it to review the defaults.

sudo nano /etc/audit/auditd.conf

Key settings to know:

  • log_file , path to the audit log (default: /var/log/audit/audit.log)
  • max_log_file , maximum log size in megabytes
  • num_logs , how many rotated log files to keep
  • space_left_action , what Auditd does when disk space runs low

For most servers, the defaults are acceptable. You can increase max_log_file to 50 and num_logs to 10 for longer retention.

Step 5: Write custom Auditd rules

Rules live in /etc/audit/rules.d/audit.rules. This is where you define what events to track. Open the file and add your rules.

sudo nano /etc/audit/rules.d/audit.rules

Add the following rules below any existing 

# Monitor changes to the passwd file
-w /etc/passwd -p wa -k user-accounts

# Monitor changes to sudoers
-w /etc/sudoers -p wa -k privilege-escalation

# Track all failed login attempts
-a always,exit -F arch=b64 -S open -F exit=-EACCES -k access-denied

# Monitor SSH configuration changes
-w /etc/ssh/sshd_config -p wa -k ssh-config

# Track use of the useradd and userdel commands
-w /usr/sbin/useradd -p x -k user-management
-w /usr/sbin/userdel -p x -k user-management

Each rule uses a key (-k) to tag events. This makes searching much easier later. The -p flag sets permissions to watch: w for write, a for attribute change, x for execute, and r for read.

For a full reference on rule syntax, check the official auditctl man page.

Step 6: Load the new rules

After saving your rules file, reload Auditd to apply them.

sudo systemctl restart auditd

Verify your rules loaded correctly:

sudo auditctl -l

You should see your rules listed in the output.

Step 7: Search audit logs with Ausearch

Ausearch lets you filter the audit log by key, user, time, or event type. Here are the most useful commands.

Search by key:

sudo ausearch -k user-accounts

Search by username:

sudo ausearch -ua root

Search for events in the last hour:

sudo ausearch --start recent

Search for failed access attempts:

sudo ausearch -k access-denied

Ausearch outputs raw audit records. Pipe them through aureport or grep to clean up the output.

Step 8: Generate reports with Aureport

Aureport summarizes audit data into readable reports. This is how you audit Linux server security events at a glance.

Show a summary of all events:

sudo aureport

Show a report of all authentication events:

sudo aureport --auth

Show failed login attempts:

sudo aureport --auth --failed

Show a report of file access events:

sudo aureport --file

Show a report of user account changes:

sudo aureport --user

These reports give you a fast overview of system activity. Run them daily as part of your security routine.

Step 9: Make rules permanent with augenrules

On some Ubuntu versions, you need to compile rules using augenrules to make them fully persistent.

sudo augenrules --load

This merges all files in /etc/audit/rules.d/ and loads them into the kernel. It’s a good habit to run this after any rule change.

Troubleshooting Common Auditd Issues on Ubuntu

Problem: Auditd fails to start

Check the service logs for errors:

sudo journalctl -u auditd --no-pager | tail -30

A common cause is a syntax error in your rules file. Run sudo auditctl -R /etc/audit/rules.d/audit.rules to test the file directly.

Problem: Rules disappear after reboot

Make sure you saved rules to /etc/audit/rules.d/audit.rules and not just loaded them temporarily with auditctl. Temporary rules don’t survive reboots. Run sudo augenrules --load after every change.

Problem: Ausearch returns no results

Check that the key name in your search matches the key in your rule exactly. Keys are case-sensitive. Also confirm the event actually occurred since Auditd was started.

Problem: Log file grows too fast

Reduce the verbosity of your rules. Avoid using -p r (read) on busy files like /etc/passwd unless you specifically need it. Read events generate a lot of noise. Also review your max_log_file and num_logs settings in auditd.conf.

Tip: Combine Ausearch with Aureport

You can pipe Ausearch output into Aureport for formatted summaries:

sudo ausearch -k privilege-escalation | sudo aureport --input-logs -i

For deeper reading on the Linux Audit system, the Red Hat Security Hardening documentation covers advanced rule strategies that also apply to Ubuntu.

Conclusion: Keep Your Server Secure with Regular Auditing

You now know how to audit Linux server security events using Auditd rules, Ausearch, and Aureport on Ubuntu. You’ve installed

Similar Posts