Auditing the system

The Linux audit system allows you to track security-related information about your systems. It allows you to watch security events, filesystem access, network access, commands run by users, and system calls.

How to do it…

By default, audit is installed as part of the core packages. So, there's no need to install this.

Configuring a centralized syslog server to accept audit logs

Perform these steps to set up the syslog server:

1. On the syslog server, create a /etc/rsyslog.d/audit_server.conf file containing the following:

   # Receive syslog audit messages via TCP over port 65514
   $ModLoad imtcp
   $InputTCPServerRun 65514
   $AllowedSender TCP, 127.0.0.1, 192.168.1.0/24
   $template HostAudit, "/var/log/audit/%$YEAR%%$MONTH%%$DAY%-%HOSTNAME%/audit.log"
   $template auditFormat, "%msg%\n" local6.*  ?HostAudit;auditFormat

2. On the syslog server, restart rsyslog, as follows:

   ~]# systemctl restart rsyslog
   

3. On the client, create a /etc/rsyslog.d/audit_client.conf file containing the following:

   $ModLoad...