Audit logging on Linux
After an incident the first question is always "what did they do?" The answer only exists if you were recording before it happened.
What to record
Authentication and privilege changes, use of sudo, changes to sensitive files, and the commands run in privileged sessions. The Linux audit framework watches syscalls and file access; shell session logging captures what a human actually typed. Together they reconstruct an incident.
Get it off the box immediately
A log an attacker can edit is not evidence. Ship audit records to a separate machine as they are written — central logging covers how — so the record survives even if the server is wiped. Pair it with file integrity monitoring so tampering itself raises an alert.
Keep it readable
Audit logs are noisy; tune the rules to the actions that matter so the signal is not buried. Retain them long enough to be useful after a slow-burn compromise, and feed the interesting events into your monitoring. If the worst happens, this is what turns a compromise from a guess into a timeline.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base