How to Use Linux Auditd for Server Security Monitoring

Linux Server Admin with Fexingo: Sysadmin, Bash, and Server Engineering · Jun 8, 2026 · 10m · transcript

Lucas and Luna dive into Linux auditd, the powerful auditing subsystem that tracks security-relevant events on your servers. They walk through a real-world scenario: detecting unauthorized file access attempts using auditctl rules, interpreting ausearch output, and generating daily reports with aureport. The episode covers how to configure auditd without overwhelming your logs, common pitfalls like rule ordering and log rotation, and a practical example of monitoring /etc/shadow for suspicious reads. By the end, you'll know how to set up a simple but effective audit trail that helps catch…