# What You Need to Know About Linux Audit Framework

DevFeed: [What You Need to Know About Linux Audit Framework](<https://devfeed.tech/articles/what-you-need-to-know-about-linux-audit-framework-29755.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/linux-audit/>)

Author: jakub.nyckowski@goteleport.com (Jakub Nyckowski)

Published: 2022-08-30T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [audit](<https://devfeed.tech/topics/audit.md>), [Linux Kernel](<https://devfeed.tech/topics/linux-kernel.md>), [Logging](<https://devfeed.tech/topics/logging.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [audit](<https://devfeed.tech/tags/audit.md>), [linux](<https://devfeed.tech/tags/linux.md>), [logging](<https://devfeed.tech/tags/logging.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This deep dive explains the Linux Audit Framework, also known as auditd, and how it records system events for post-mortem analysis. It describes kernel-level auditing, configurable rules, event propagation through netlink, and filesystem storage of audit events.

## Source excerpt

In this blog post, we'll deep-dive into Linux Audit Framework.