Linux Audit Events Beta

Linux Audit Events Reference

The auditd and PAM records that give an auditor or analyst direct evidence — the same rigor as the Windows Event Log Reference, for hosts that don't run Windows.

This page is early and growing. The Windows Event Log Reference took many iterative passes to reach its current 99 events; this Linux catalog is starting the same way, deliberately, rather than trying to cover everything at once. It now covers process execution, the full authentication chain, account-file tampering, host-integrity signals (kernel modules, SSH config, time manipulation), network connections, mounts, cron/systemd persistence, and unit start/stop tracking. Genuine journald-only content (no audit-subsystem equivalent), broader file-access coverage, and more granular sudo-command logging (USER_CMD) are the next passes, not yet here.

Sourcing: Every rule below is grounded in the CIS Distribution Independent Linux Benchmark's actual recommended auditctl syntax, cross-checked against real, current configuration references — not written from memory. The exact rule syntax is shown for each event, the same way filtering guidance is shown for Windows events.