auditctl komutu

Giriş

Açıklaması şöyle

The Linux kernel audit subsystem provides a mechanism for collecting and logging security events like access to sensitive files or system calls. It can help you troubleshoot unexpected behavior or collect forensic evidence in the event of a security breach. The audit subsystem is on by default on Amazon Linux 2, but it is not configured to log syscalls.

Security events'i toplan şey auditd sistemi. auditd ile ilgili bir soru burada

-a seçeneği

Örnek

Şöyle yaparız. Tüm audit toplamayı engeller

auditctl -a never,task