Operations | Monitoring | ITSM | DevOps | Cloud

February 2018

Back to Basics: Working with Linux Audit Daemon Log File

If you run the audit daemon on your Linux distribution you might notice that some of the most valuable information produced by auditd is not transmitted when you enable syslog forwarding to Graylog. By default, these messages are written to /var/log/audt/audit.log, which is written to file by the auditd process directly and not sent via syslog.