Chapter 25. Linux Auditing System

In This Chapter

Configuring the Audit Daemon Writing Audit Rules and Watches Starting and Stopping the Daemon Analyzing the Records Tracing a Process with Audit

The 2.6 Linux kernel has the ability to log events such as system calls and file access. These logs can then be reviewed by the administrator to determine possible security breaches such as failed login attempts or a user failing to access system files. This functionality, called the Linux Auditing System, is available in Red Hat Enterprise Linux 5.