Last Updated: November 21, 2025
Focus Areas
| Focus |
|---|
Define watch rules
|
Monitor `ausearch` output
|
Commands & Queries
auditctl -w /etc/passwd -p wa -k passwd_changes
Watch password file
ausearch -k passwd_changes
Review events
auditctl -l
List rules
Summary
Audit rules reveal who touched critical resources.
💡 Pro Tip:
Store audit logs centrally and rotate them.