> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux auditd

> Send Linux auditd records and journald auth messages to Sazabi through Fluent Bit or the OpenTelemetry Collector, with audit fields parsed into attributes.

[All Linux auditd integration capabilities](https://docs.sazabi.com/catalogs/integrations/auditd)

## About

Linux auditd records logins, authentication, `sudo` commands, and changes to watched files in `/var/log/audit/audit.log`. sshd, sudo, PAM, and systemd-logind write auth messages to the systemd journal (the same messages `/var/log/auth.log` or `/var/log/secure` hold). A Fluent Bit or OpenTelemetry Collector agent on each host reads both, parses the key fields, and pushes them to Sazabi over OTLP/HTTPS.

| Stream | `service.name` | Parsed attributes |
| - | - | - |
| Audit records | `auditd` | `host.name`, `audit_type`, `audit_serial`, `auid`, `uid`, `ses`, `exe`, `acct`, `addr`, `terminal`, `res`, `key`, and the `UID`/`AUID` names in enriched format |
| Auth messages | `linux-auth` | severity, `syslog_identifier`, `pid`, `hostname`, `systemd_unit` |

Two limits to know:

* Each audit line is its own record. Multi-line events (`SYSCALL`, `EXECVE`, `PATH`) share an `audit_serial` but are not joined.
* `sudo` command lines in `USER_CMD` records stay hex-encoded in the `cmd` attribute, as auditd writes them.

## Prerequisites

* auditd installed (`apt-get install auditd` or `dnf install audit`) and systemd-journald on each host.
* Fluent Bit v3.1 or later, or the OpenTelemetry Collector Contrib distribution installed on the host. The Collector's `journald` receiver runs `journalctl`, which the upstream container image does not include.
* The collector runs as root, or as a user in the `systemd-journal` group that can read the audit log.
* Your Sazabi intake URL, shown on the log source setup screen.

## Set up in the dashboard

**Step 1**

### Create the log source

Open **Settings > Log sources**, add **Linux auditd**, and keep the setup screen open. The configs on that screen already contain your intake host.

**Step 2**

### Add audit rules

PAM records logins, authentication, and `sudo` commands with no extra rules. Add these rules to watch account, sudoers, and SSH config files and to record commands run as root by a logged-in user:

```bash title="/etc/audit/rules.d/sazabi.rules" theme={"system"}
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd_config
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=unset -k root_commands
```

Load them with `sudo augenrules --load` and check with `sudo auditctl -l`. If the host already ships a rule set, add only the rules it lacks.

**Step 3**

### Install the collector config

Copy the **Fluent Bit** or **OpenTelemetry Collector** config from the setup screen. Both tail `/var/log/audit/audit.log` and split each line into the record type, timestamp, serial, and key=value fields, including the quoted `msg='…'` payload. Both read journald entries with `SYSLOG_FACILITY` 4 (auth) and 10 (authpriv), and drop kernel audit copies so records are not sent twice.

* **Fluent Bit:** save it as `/etc/fluent-bit/fluent-bit.yaml`, create `/var/lib/fluent-bit`, and start Fluent Bit with `-c /etc/fluent-bit/fluent-bit.yaml`.
* **OpenTelemetry Collector:** save it as `/etc/otelcol-contrib/config.yaml` and create `/var/lib/otelcol/storage`.

On hosts that write auth messages only to files, replace the journald input with a tail of `/var/log/auth.log` (Debian, Ubuntu) or `/var/log/secure` (RHEL family).

**Step 4**

### Restart and generate events

Restart the collector (`sudo systemctl restart fluent-bit` or `sudo systemctl restart otelcol-contrib`), then SSH into the host and run `sudo true`.

## Set up with the CLI

You can also register the Linux auditd log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

```bash theme={"system"}
sazabi log-sources create auditd --mode manual
```

The command prints the intake URL for the new source. Use its hostname as the collector's host in the configuration shown above. Run `sazabi log-sources setup-instructions` with the new log source's ID to print the audit rules and collector configs with the intake host filled in.

## Verify

Open the **Intake** page and filter by service `auditd` or `linux-auth`. Expect `USER_LOGIN`, `USER_AUTH`, and `USER_CMD` audit records and sshd and sudo auth messages within a minute. You can also ask the agent: "Which users ran sudo on my hosts in the last hour?"

## Troubleshooting

* **Permission denied on the audit log or journal:** run the collector as root, or grant the groups above.
* **No auth messages:** `journalctl SYSLOG_FACILITY=10 -n 5` returns nothing when the host logs auth only to files; use the file tail.
* **`journalctl` not found:** install the Collector Contrib package on the host instead of running the container image.
* **TLS or DNS errors:** allow outbound HTTPS on port 443 to your intake host.

## Further reading

> [card] [auditd rules](https://man7.org/linux/man-pages/man7/audit.rules.7.html)
>
> Syntax for audit watch and syscall rules.

> [card] [Fluent Bit systemd input](https://docs.fluentbit.io/manual/pipeline/inputs/systemd)
>
> Journal matches and options for the auth stream.

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> Confirm records arriving from each log source.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.