--- title: What You Need to Know About Linux Audit Framework description: Linux Audit Framework (auditd) is a kernel-level auditing system that logs system events like executed commands, syscalls, file access, and network activity... canonical: https://daily.dev/posts/what-you-need-to-know-about-linux-audit-framework-knlz83sl3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What You Need to Know About Linux Audit Framework | daily.dev og:description: Linux Audit Framework (auditd) is a kernel-level auditing system that logs system events like executed commands, syscalls, file access, and network activity... og:url: https://daily.dev/posts/what-you-need-to-know-about-linux-audit-framework-knlz83sl3 og:image: https://api.daily.dev/og/posts/knlZ83sl3.png og:image:alt: What You Need to Know About Linux Audit Framework og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What You Need to Know About Linux Audit Framework **[Teleport](https://daily.dev/sources/teleport)** · 9 min read · 0 upvotes · 0 comments ## Summary Linux Audit Framework (auditd) is a kernel-level auditing system that logs system events like executed commands, syscalls, file access, and network activity for post-mortem security analysis. It works by having the kernel propagate events via netlink to the auditd daemon running in userspace, avoiding the need to instrument individual applications. Key tools include autrace for tracing single process executions, ausearch for filtering event logs, aureport for aggregated summaries, and auditctl for managing rules. Drawbacks include performance overhead and potential event loss when disk space runs out or with certain flush policies. BPF (via tools like bcc) is presented as a modern alternative, already used by companies like Netflix, Uber, and Teleport for lower-overhead tracing and auditing tasks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happens to auditd logs when the disk runs out of free space? By default, auditd logs a warning message and stops recording events to persistent disk when free space runs out, which can cause important events to be missed and make later analysis impossible. This behavior can be changed by setting the disk_full_action option to HALT or SUSPEND in the audit configuration file. _Teams hardening production audit pipelines can track configuration gotchas like this via daily.dev._ ### How do I trace a single process execution with Linux auditd? Use the autrace command followed by the executable path, for example autrace /bin/ls, which runs the process and records everything that happens during its execution. The output points to a session identifier that can then be passed to ausearch, using ausearch -i -p , to view detailed syscall and process records for that trace. _daily.dev helps developers keep practical auditd and syscall-tracing techniques within reach._ ### Can BPF replace the Linux Audit Framework (auditd) for system auditing? BPF (via tools like bcc) can already replace many auditd use cases because it runs safely in the kernel with access to all syscalls, and unlike auditd it wasn't designed only for auditing so it supports broader, more customizable tracing. Netflix uses BPF to trace network packets using under 1% of CPU and memory, and Teleport uses BPF to trace user activity during remote sessions instead of relying on Linux Audit. _Anyone weighing auditd against eBPF-based tracing can follow real-world comparisons like this on daily.dev._ ## Similar posts on daily.dev - [Kubernetes Auditing and Events: Monitoring Cluster Activity](https://daily.dev/posts/kubernetes-auditing-and-events-monitoring-cluster-activity-tx3h1mgqy) · The New Stack · 2 upvotes · 0 comments - [12 eBPF-Powered CLI Utilities That Every Modern Linux Sysadmin Should Master](https://daily.dev/posts/12-ebpf-powered-cli-utilities-that-every-modern-linux-sysadmin-should-master-xhmtccbiq) · It's Foss · 1 upvotes · 0 comments - [Building a Dockerized AI-Powered Host Vulnerability Assessment Tool](https://daily.dev/posts/building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-gdsdh4rqq) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/what-you-need-to-know-about-linux-audit-framework-knlz83sl3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What You Need to Know About Linux Audit Framework","url":"https://daily.dev/posts/what-you-need-to-know-about-linux-audit-framework-knlz83sl3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-you-need-to-know-about-linux-audit-framework-knlz83sl3"},"datePublished":"2026-08-23T12:22:50.908Z","dateModified":"2026-08-23T12:49:15.210Z","description":"Linux Audit Framework (auditd) is a kernel-level auditing system that logs system events like executed commands, syscalls, file access, and network activity...","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-you-need-to-know-about-linux-audit-framework-knlz83sl3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"What You Need to Know About Linux Audit Framework"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-you-need-to-know-about-linux-audit-framework-knlz83sl3#faq","mainEntity":[{"@type":"Question","name":"What happens to auditd logs when the disk runs out of free space?","acceptedAnswer":{"@type":"Answer","text":"By default, auditd logs a warning message and stops recording events to persistent disk when free space runs out, which can cause important events to be missed and make later analysis impossible. This behavior can be changed by setting the disk_full_action option to HALT or SUSPEND in the audit configuration file. Teams hardening production audit pipelines can track configuration gotchas like this via daily.dev."}},{"@type":"Question","name":"How do I trace a single process execution with Linux auditd?","acceptedAnswer":{"@type":"Answer","text":"Use the autrace command followed by the executable path, for example autrace /bin/ls, which runs the process and records everything that happens during its execution. The output points to a session identifier that can then be passed to ausearch, using ausearch -i -p , to view detailed syscall and process records for that trace. daily.dev helps developers keep practical auditd and syscall-tracing techniques within reach."}},{"@type":"Question","name":"Can BPF replace the Linux Audit Framework (auditd) for system auditing?","acceptedAnswer":{"@type":"Answer","text":"BPF (via tools like bcc) can already replace many auditd use cases because it runs safely in the kernel with access to all syscalls, and unlike auditd it wasn't designed only for auditing so it supports broader, more customizable tracing. Netflix uses BPF to trace network packets using under 1% of CPU and memory, and Teleport uses BPF to trace user activity during remote sessions instead of relying on Linux Audit. Anyone weighing auditd against eBPF-based tracing can follow real-world comparisons like this on daily.dev."}}]} ```