Which tool can be used to manage the Linux Audit system?

Question

Options

• Aauditd
• Brkhunter
• Cchkrootkit
• Dmaldet

• A
  93% (50)
• B
  2% (1)
• C
  4% (2)
• D
  2% (1)

Explanation

auditd is the daemon that manages the Linux Audit system - it monitors and logs security-relevant events (file access, syscalls, authentication) and is configured via auditctl, ausearch, and aureport. It is the native Linux kernel auditing tool.

Why the distractors are wrong:

• B. rkhunter (Rootkit Hunter) scans for rootkits, backdoors, and local exploits - it's a detection scanner, not an audit manager.
• C. chkrootkit similarly checks for rootkit signatures on the system; it has no role in the Linux Audit subsystem.
• D. maldet (Linux Malware Detect) is a malware scanner focused on shared hosting environments - unrelated to audit management.

Memory tip: Think "auditd = audit daemon" - just as sshd manages SSH and httpd manages HTTP, auditd is the daemon that runs and manages the Linux Audit framework.

No community discussion yet for this question.