Linux Audit Framework: Tracking Who Did What on Your Servers

Fri, 03 Oct 2025 11:00:00 +0000

The moment a server does something you didn’t expect — a file changes, a binary appears, a user gains a privilege they shouldn’t have — the first question is always the same: who did this, and when? Ordinary logs rarely answer it. They tell you a service restarted, not that someone read /etc/shadow at 02:14. For the real answer you need the Linux Audit Framework, the kernel-level recorder that has been sitting on your box this whole time, almost certainly underused.

Auditd - Tag - vo.rs

Linux Audit Framework: Tracking Who Did What on Your Servers