Glossary
auditd (Linux Audit Daemon)
The userspace daemon that collects and logs Linux kernel audit events, providing a tamper-evident trail of security-relevant activity.
auditd is the userspace component of the Linux Audit system. It receives security-relevant events from the kernel and writes them to disk, creating a detailed record of system calls, file accesses, and policy changes. This gives administrators the accountability and forensic trail needed to investigate incidents and prove compliance.
Rules defining what to watch are loaded with auditctl or placed in /etc/audit/rules.d/, and events are written to /var/log/audit/audit.log, which can be searched with ausearch.