How To Install audit on Fedora 36

In this tutorial we learn how to install audit in Fedora 36. audit is User space tools for kernel auditing

Introduction

In this tutorial we learn how to install audit on Fedora 36.

What is audit

The audit package contains the user space utilities for storing and searching the audit records generated by the audit subsystem in the Linux 2.6 and later kernels.

We can use yum or dnf to install audit on Fedora 36. In this tutorial we discuss both methods but you only need to choose one of method to install audit.

Install audit on Fedora 36 Using dnf

Update yum database with dnf using the following command.

sudo dnf makecache --refresh

After updating yum database, We can install audit using dnf by running the following command:

sudo dnf -y install audit

Install audit on Fedora 36 Using yum

Update yum database with yum using the following command.

sudo yum makecache --refresh

After updating yum database, We can install audit using yum by running the following command:

sudo yum -y install audit

How To Uninstall audit on Fedora 36

To uninstall only the audit package we can use the following command:

sudo dnf remove audit

audit Package Contents on Fedora 36

/etc/audit
/etc/audit/audit-stop.rules
/etc/audit/audit.rules
/etc/audit/auditd.conf
/etc/audit/plugins.d
/etc/audit/plugins.d/af_unix.conf
/etc/audit/rules.d
/etc/audit/rules.d/audit.rules
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/bin/auvirt
/usr/lib/.build-id
/usr/lib/.build-id/4b
/usr/lib/.build-id/4b/b0a0387705d86f986b0ad5aada4058261ee12d
/usr/lib/.build-id/53
/usr/lib/.build-id/53/a8f47c28c5bfaba3314c2d19004f75ac592196
/usr/lib/.build-id/82
/usr/lib/.build-id/82/84c11215d3ed138b457128ae40ce1b6619963f
/usr/lib/.build-id/97
/usr/lib/.build-id/97/55d53737d822306f46a2fedcb5e7a0632eb922
/usr/lib/.build-id/a3
/usr/lib/.build-id/a3/476e1a5a95141e2769b7df7415e8f74c6f2e8e
/usr/lib/.build-id/b4
/usr/lib/.build-id/b4/e9e55ead58475ce56795f50e4fc0eb23ffc22e
/usr/lib/.build-id/e5
/usr/lib/.build-id/e5/fa1556cee4693c3cc7f9ae4a0d22ef65647967
/usr/lib/.build-id/e8
/usr/lib/.build-id/e8/9991efdbc3384586925b86756bb1791f5e831b
/usr/lib/.build-id/f6
/usr/lib/.build-id/f6/dc4442e833b48ab12d9e6da82378cb753163ed
/usr/lib/systemd/system/auditd.service
/usr/libexec/audit-functions
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditctl
/usr/sbin/auditd
/usr/sbin/augenrules
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/sbin/autrace
/usr/share/audit
/usr/share/audit/sample-rules
/usr/share/audit/sample-rules/10-base-config.rules
/usr/share/audit/sample-rules/10-no-audit.rules
/usr/share/audit/sample-rules/11-loginuid.rules
/usr/share/audit/sample-rules/12-cont-fail.rules
/usr/share/audit/sample-rules/12-ignore-error.rules
/usr/share/audit/sample-rules/20-dont-audit.rules
/usr/share/audit/sample-rules/21-no32bit.rules
/usr/share/audit/sample-rules/22-ignore-chrony.rules
/usr/share/audit/sample-rules/23-ignore-filesystems.rules
/usr/share/audit/sample-rules/30-nispom.rules
/usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-3-access-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules
/usr/share/audit/sample-rules/30-ospp-v42.rules
/usr/share/audit/sample-rules/30-pci-dss-v31.rules
/usr/share/audit/sample-rules/30-stig.rules
/usr/share/audit/sample-rules/31-privileged.rules
/usr/share/audit/sample-rules/32-power-abuse.rules
/usr/share/audit/sample-rules/40-local.rules
/usr/share/audit/sample-rules/41-containers.rules
/usr/share/audit/sample-rules/42-injection.rules
/usr/share/audit/sample-rules/43-module-load.rules
/usr/share/audit/sample-rules/44-installers.rules
/usr/share/audit/sample-rules/70-einval.rules
/usr/share/audit/sample-rules/71-networking.rules
/usr/share/audit/sample-rules/99-finalize.rules
/usr/share/audit/sample-rules/README-rules
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man5/ausearch-expression.5.gz
/usr/share/man/man7/audit.rules.7.gz
/usr/share/man/man8/auditctl.8.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/augenrules.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/usr/share/man/man8/autrace.8.gz
/usr/share/man/man8/auvirt.8.gz
/var/log/audit
/var/run/auditd.state

References

Summary

In this tutorial we learn how to install audit on Fedora 36 using yum and [dnf]((/fedora/36/dnf/).