What is the purpose of the Linux Audit system?

Question

Options

• ATo manage system log files
• BTo automate host scans
• CTo detect intrusions and system changes
• DTo manage installed packages

• A
  4% (2)
• B
  2% (1)
• C
  93% (43)

Explanation

The Linux Audit system (auditd) is a kernel-level security framework designed to detect intrusions and track system changes - it records security-relevant events like file access, privilege escalation, system calls, and authentication attempts, giving administrators a forensic trail for compliance and incident response.

Why the distractors are wrong:

• A (manage log files): That's the role of tools like logrotate or rsyslog; audit logs are just one output of the audit system, not its purpose.
• B (automate host scans): Scanning is handled by tools like OpenSCAP or Lynis; the audit system is passive and event-driven, not a scanner.
• D (manage packages): Package management belongs to apt, dnf, or rpm - entirely unrelated.

Memory tip: Think of auditd as a courthouse stenographer - it silently records everything that happens on the system so there's an official record if something goes wrong. The word audit itself means "official examination of records," which maps directly to its function.

No community discussion yet for this question.