Overview

When enabled, Audit Log Monitoring provides:

Process execution events
File access and modification tracking
User and group identity changes
Authentication and authorization errors
Syscall-level visibility (execve, open, connect, etc.)
Detection of privilege escalation attempts
Custom audit rule support (inline + external files)

Audit rules can be configured globally or per host, giving full control over what activities are monitored.

Requirements

Component	Requirement
Agent	`atatus-infra-agent`
Version	4.2.0+
Supported OS	Linux with kernel audit support
Service	auditd or kernel audit subsystem must be available

Configuration File

Audit monitoring is configured under: /etc/atatus-infra-agent/conf.d/auditd.d/auditd.yml

Full Configuration Example

Below is your configuration rewritten cleanly as official documentation:

copy

metrics:
  - auditd:
      # General Options
      resolve_ids: true               # Map UID/GID → usernames
      failure_mode: silent            # Kernel audit failure mode: silent | log | panic
      backlog_limit: 8196             # Max buffered audit messages
      rate_limit: 0                   # Kernel audit rate limit (messages/sec)

      include_raw_message: false      # Include unparsed raw audit records
      include_warnings: false         # Include audit subsystem warnings
      # keep_null: false              # Publish fields with null values

      # Audit Rules – External Files
      audit_rule_files:
        - '${path.config}/audit.rules.d/*.conf'

      # Inline Audit Rules
      audit_rules: |
        ## Define audit rules here.
        ## Use -w for file watches and -a/-A for syscall audits.

        ## Example: Detect 32-bit syscall usage on 64-bit hosts
        # -a always,exit -F arch=b32 -S all -F key=32bit-abi

        ## Example: Monitor process executions
        # -a always,exit -F arch=b64 -S execve,execveat -k exec

        ## Example: Monitor network syscall activity
        # -a always,exit -F arch=b64 -S accept,bind,connect -k external-access

        ## Example: Monitor identity file changes
        # -w /etc/passwd -p wa -k identity
        # -w /etc/group  -p wa -k identity
        # -w /etc/gshadow -p wa -k identity

        ## Example: Unauthorized file access attempts
        # -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat \
        #   -F exit=-EACCES -k access
        # -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat \
        #   -F exit=-EPERM -k access

Key Settings Explained

General

Setting	Description
`resolve_ids`	Converts numeric UID/GID to usernames
`failure_mode`	Kernel behavior when audit fails (`silent`, `log`, `panic`)
`backlog_limit`	Max queued audit messages to avoid drops
`rate_limit`	Throttle kernel audit messages/sec

Rule Loading

Audit rules control what system activity is captured.

1. External Rule Files

Uses files similar to /etc/audit/rules.d/*.rules:

audit_rule_files:
  - '${path.config}/audit.rules.d/*.conf'

2. Inline Audit Rules

Rules embedded directly in the config:

-w → Watch specific files/directories
-a / -A → Add syscall audit rules
-k → Assign rule key (for grouping/searching)

Common Use Cases

Track all executed commands

-a always,exit -F arch=b64 -S execve,execveat -k exec

Detect changes to critical system files

-w /etc/passwd -p wa -k identity

Log unauthorized file access

-a always,exit -F arch=b64 -S open -F exit=-EACCES -k access

Viewing Audit Events

Audit events appear under:

Security → Cloud Siem → Audit Logs → Events

You will see:

User identity
Process name & PID
Command executed (execve)
File paths
Syscalls
IP/port (for network syscalls)
Success / failure
Grouped by rule keys

Restart the Agent

copy

sudo systemctl restart atatus-infra-agent