Skip to main content
All Linux auditd integration capabilities

​
About

Linux auditd records logins, authentication, sudo commands, and changes to watched files in /var/log/audit/audit.log. sshd, sudo, PAM, and systemd-logind write auth messages to the systemd journal (the same messages /var/log/auth.log or /var/log/secure hold). A Fluent Bit or OpenTelemetry Collector agent on each host reads both, parses the key fields, and pushes them to Sazabi over OTLP/HTTPS. Two limits to know:
  • Each audit line is its own record. Multi-line events (SYSCALL, EXECVE, PATH) share an audit_serial but are not joined.
  • sudo command lines in USER_CMD records stay hex-encoded in the cmd attribute, as auditd writes them.

​
Prerequisites

  • auditd installed (apt-get install auditd or dnf install audit) and systemd-journald on each host.
  • Fluent Bit v3.1 or later, or the OpenTelemetry Collector Contrib distribution installed on the host. The Collector’s journald receiver runs journalctl, which the upstream container image does not include.
  • The collector runs as root, or as a user in the systemd-journal group that can read the audit log.
  • Your Sazabi intake URL, shown on the log source setup screen.

​
Set up in the dashboard

1

​
Create the log source

Open Settings > Log sources, add Linux auditd, and keep the setup screen open. The configs on that screen already contain your intake host.
2

​
Add audit rules

PAM records logins, authentication, and sudo commands with no extra rules. Add these rules to watch account, sudoers, and SSH config files and to record commands run as root by a logged-in user:
/etc/audit/rules.d/sazabi.rules
Load them with sudo augenrules --load and check with sudo auditctl -l. If the host already ships a rule set, add only the rules it lacks.
3

​
Install the collector config

Copy the Fluent Bit or OpenTelemetry Collector config from the setup screen. Both tail /var/log/audit/audit.log and split each line into the record type, timestamp, serial, and key=value fields, including the quoted msg='…' payload. Both read journald entries with SYSLOG_FACILITY 4 (auth) and 10 (authpriv), and drop kernel audit copies so records are not sent twice.
  • Fluent Bit: save it as /etc/fluent-bit/fluent-bit.yaml, create /var/lib/fluent-bit, and start Fluent Bit with -c /etc/fluent-bit/fluent-bit.yaml.
  • OpenTelemetry Collector: save it as /etc/otelcol-contrib/config.yaml and create /var/lib/otelcol/storage.
On hosts that write auth messages only to files, replace the journald input with a tail of /var/log/auth.log (Debian, Ubuntu) or /var/log/secure (RHEL family).
4

​
Restart and generate events

Restart the collector (sudo systemctl restart fluent-bit or sudo systemctl restart otelcol-contrib), then SSH into the host and run sudo true.

​
Set up with the CLI

You can also register the Linux auditd log source with the Sazabi CLI (installed and authenticated — see CLI reference). Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):
The command prints the intake URL for the new source. Use its hostname as the collector’s host in the configuration shown above. Run sazabi log-sources setup-instructions with the new log source’s ID to print the audit rules and collector configs with the intake host filled in.

​
Verify

Open the Intake page and filter by service auditd or linux-auth. Expect USER_LOGIN, USER_AUTH, and USER_CMD audit records and sshd and sudo auth messages within a minute. You can also ask the agent: “Which users ran sudo on my hosts in the last hour?”

​
Troubleshooting

  • Permission denied on the audit log or journal: run the collector as root, or grant the groups above.
  • No auth messages: journalctl SYSLOG_FACILITY=10 -n 5 returns nothing when the host logs auth only to files; use the file tail.
  • journalctl not found: install the Collector Contrib package on the host instead of running the container image.
  • TLS or DNS errors: allow outbound HTTPS on port 443 to your intake host.

​
Further reading

auditd rules

Syntax for audit watch and syscall rules.

Fluent Bit systemd input

Journal matches and options for the auth stream.

Intake

Confirm records arriving from each log source.