SUSE Linux Enterprise - Audit Quick Start

Abstract

Linux audit allows you to comprehensively log and track access to files, directories, and resources of your system, as well as trace system calls. It enables you to monitor your system for application misbehavior or code malfunctions. By creating a sophisticated set of rules including file watches and system call auditing, you can make sure that any violation of your security policies is noted and properly addressed.

Contents

• 1. Enabling Audit
• 2. Configuring Audit
• 3. Setting Up Audit Rules
• 4. Generating Reports
• 5. Analyzing Audit Log Files and Reports
• 6. Analyzing Individual System Calls
• 7. Audit Tool Set
• 8. Files
• 9. For More Information
• 10. Legal Notice
• 11. GNU Free Documentation License