Where Are Linux auditd Logs Stored?
Linux audit.log path, rules files and ausearch query basics.
Last updated
auditd writes syscall and file-watch events to audit.log under /var/log/audit, governed by rules in /etc/audit that load at boot. Raw logs overwhelm humans, so ausearch and aureport do the reading.
Size log partitions generously since audit floods under active rules. Immutable rules need reboots to change, which surprises first-time hardeners.
Where Linux stores this, by platform
/var/log/audit/audit.log
Main audit event log with rotated archives beside it. Rules live in /etc/audit/rules.d with the daemon config in auditd.conf. Query with ausearch and aureport, never bare tail on busy hosts.
Frequently asked questions
How do I search audit logs?
Use ausearch against the log above by syscall, file or user. aureport summarizes the same data for compliance windows.
Why did audit rules vanish after reboot?
Unwritten rules never persisted to /etc/audit beside the log above. Save with augenrules before rebooting.
Notice an outdated path? Let us know.