Açıklaması şöyle
The Linux kernel audit subsystem provides a mechanism for collecting and logging security events like access to sensitive files or system calls. It can help you troubleshoot unexpected behavior or collect forensic evidence in the event of a security breach. The audit subsystem is on by default on Amazon Linux 2, but it is not configured to log syscalls.Security events'i toplan şey auditd sistemi. auditd ile ilgili bir soru burada
-a seçeneği
Örnek
Şöyle yaparız. Tüm audit toplamayı engeller
auditctl -a never,task
