audit is a very important logging service that helps us inspect various anomalies. For example, if someone attempts to log in and fails, you can find more details about it here. More usefully, we can analyze the /var/log/audit/audit.log logs to identify operations mistakenly blocked by the firewall, and then apply a patch to get the system working properly.

I recently noticed that audit.log hadn’t been updating normally for quite some time. Looking at when it stopped, it seems to coincide with an occasion when someone misconfigured system permissions. The service may have had its permissions stripped and been stopped. The log that monitors permissions had its own permissions stopped—how awkward.

RedHat You can find details here; we just need to restart the auditd service.

Bash
sudo service auditd restart

You’ll see that it starts updating again.

The parameters you can add after service auditd are as follows:

  • stop — Stop the auditd service.
    • <li><strong>restart</strong> — Restart the auditd service.</li>

<li><strong>reload</strong> or <strong>force-reload</strong> — Reload the auditd service from /etc/audit/auditd.conf.</li>

<li><strong>rotate</strong> — Rotate logs in the /var/log/audit/ directory.</li>

<li><strong>resume</strong> — Resume auditd log updates. In our case, if updates were only paused but auditd wasn’t killed, this parameter would be enough.</li>

<li><strong>condrestart</strong> or <strong>try-restart</strong> — Restart auditd if it is already running; otherwise, do nothing.</li>
<li><strong>status</strong> — Show the auditd running status.</li>

To enable this service to start on boot, run the following command:

Bash
sudo chkconfig auditd on