Which function of Linux is used by FortiSIEM for collecting logs?

Question

Options

• Aaureport
• Bausearch
• Cautrace
• Dauditd

• B
  3% (1)
• C
  3% (1)
• D
  94% (31)

Explanation

auditd is the Linux Audit daemon - a background service that interfaces with the kernel's audit subsystem to continuously capture and record security-relevant events (file access, system calls, authentication, etc.) to log files. FortiSIEM relies on auditd because it is the collector, not a query or analysis tool.

Why the distractors are wrong:

• A. aureport - generates formatted summary reports from already-collected audit logs; it doesn't collect anything.
• B. ausearch - searches and queries existing audit log files; again, a read/analysis tool, not a collector.
• C. autrace - traces system calls for a specific process (similar to strace), useful for debugging but not for broad, ongoing log collection.

Memory tip: All four tools share the au- prefix (Linux audit suite), but only auditd ends in d for daemon - and daemons are the ones that run continuously in the background collecting data. If it's a daemon, it collects; if it's a utility (report/search/trace), it processes what's already there.

No community discussion yet for this question.