Control the Linux audit system
high risk
auditctl -lReview existing rules firstAdd, list and delete kernel audit rules.
| Flag | Meaning |
|---|---|
-l | List rules |
-w | Watch a file |
-D | Delete all rules |
-e 2 | Lock configuration (immutable until reboot) |
auditctl -lList rules · explain & risk-check →auditctl -w /etc/passwd -p wa -k passwdWatch writes to /etc/passwd · explain & risk-check →Reference text is hand-written and may be incomplete — check man auditctl for your version. Test destructive commands on a non-production system first.