How To Install audit on Rocky Linux 8
In this tutorial we learn how to install audit on Rocky Linux 8. audit is User space tools for kernel auditing
Introduction
In this tutorial we learn how to install audit on Rocky Linux 8.
What is audit
The audit package contains the user space utilities for storing and searching the audit records generated by the audit subsystem in the Linux 2.6 and later kernels.
We can use yum or dnf to install audit on Rocky Linux 8. In this tutorial we discuss both methods but you only need to choose one of method to install audit.
Install audit on Rocky Linux 8 Using dnf
Update yum database with dnf using the following command.
sudo dnf makecache --refresh
After updating yum database, We can install audit using dnf by running the following command:
sudo dnf -y install audit
Install audit on Rocky Linux 8 Using yum
Update yum database with yum using the following command.
sudo yum makecache --refresh
After updating yum database, We can install audit using yum by running the following command:
sudo yum -y install audit
How To Uninstall audit on Rocky Linux 8
To uninstall only the audit package we can use the following command:
sudo dnf remove audit
audit Package Contents on Rocky Linux 8
/etc/audit
/etc/audit/audit-stop.rules
/etc/audit/audit.rules
/etc/audit/auditd.conf
/etc/audit/plugins.d
/etc/audit/plugins.d/af_unix.conf
/etc/audit/rules.d
/etc/audit/rules.d/audit.rules
/sbin/auditctl
/sbin/auditd
/sbin/augenrules
/sbin/aureport
/sbin/ausearch
/sbin/autrace
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/bin/auvirt
/usr/lib/.build-id
/usr/lib/.build-id/21
/usr/lib/.build-id/21/18c43c5ef9865ae27995a2a2a4540585c9a514
/usr/lib/.build-id/2d
/usr/lib/.build-id/2d/15af867a2ac2fb14433ff465d6f1882fcc805c
/usr/lib/.build-id/3c
/usr/lib/.build-id/3c/280360c8f1a5f880c4ff025acd3d92197a580f
/usr/lib/.build-id/48
/usr/lib/.build-id/48/12eabc37b1f28b8d5ea4bb9241609d0b7d18c1
/usr/lib/.build-id/7e
/usr/lib/.build-id/7e/6ebd3f1282ad08b5c7ae62fea2bb5b201ab40c
/usr/lib/.build-id/84
/usr/lib/.build-id/84/b8a37f2f593ebeaf190755b28776e4cb860d5f
/usr/lib/.build-id/9c
/usr/lib/.build-id/9c/fac8df7aba6601ec3cc894b3cdd4088af8285e
/usr/lib/.build-id/d6
/usr/lib/.build-id/d6/c20c97a4bd9674a743778a23e19f597bf2b5b6
/usr/lib/.build-id/da
/usr/lib/.build-id/da/1254dae5bf5c6c20abec91b204bdae9b4eb418
/usr/lib/systemd/system/auditd.service
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/share/audit/sample-rules/10-base-config.rules
/usr/share/audit/sample-rules/10-no-audit.rules
/usr/share/audit/sample-rules/11-loginuid.rules
/usr/share/audit/sample-rules/12-cont-fail.rules
/usr/share/audit/sample-rules/12-ignore-error.rules
/usr/share/audit/sample-rules/20-dont-audit.rules
/usr/share/audit/sample-rules/21-no32bit.rules
/usr/share/audit/sample-rules/22-ignore-chrony.rules
/usr/share/audit/sample-rules/23-ignore-filesystems.rules
/usr/share/audit/sample-rules/30-nispom.rules
/usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-3-access-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules
/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules
/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules
/usr/share/audit/sample-rules/30-ospp-v42.rules
/usr/share/audit/sample-rules/30-pci-dss-v31.rules
/usr/share/audit/sample-rules/30-stig.rules
/usr/share/audit/sample-rules/31-privileged.rules
/usr/share/audit/sample-rules/32-power-abuse.rules
/usr/share/audit/sample-rules/40-local.rules
/usr/share/audit/sample-rules/41-containers.rules
/usr/share/audit/sample-rules/42-injection.rules
/usr/share/audit/sample-rules/43-module-load.rules
/usr/share/audit/sample-rules/70-einval.rules
/usr/share/audit/sample-rules/71-networking.rules
/usr/share/audit/sample-rules/99-finalize.rules
/usr/share/audit/sample-rules/README-rules
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man5/ausearch-expression.5.gz
/usr/share/man/man7/audit.rules.7.gz
/usr/share/man/man8/auditctl.8.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/augenrules.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/usr/share/man/man8/autrace.8.gz
/usr/share/man/man8/auvirt.8.gz
/var/log/audit
/var/run/auditd.state
References
Summary
In this tutorial we learn how to install audit on Rocky Linux 8 using yum and dnf.