Locating and Exporting Linux auditd Records
This article covers the location of Linux auditd records and methods for exporting them. It says the main log is restricted to root and shows how ausearch can pull a selected time range in its native format. If auditd is absent, as is common on Debian and Ubuntu, kernel audit events can be retrieved from the journal.
The audit daemon stores its primary trail in /var/log/audit/audit.log, and access is limited to root. A raw export for a chosen period can be produced with ausearch, preserving the native record format. On systems without auditd—commonly Debian and Ubuntu—kernel audit messages are available through the journal and can be filtered by transport.
Default installations differ: Red Hat-family distributions include auditd, while Debian/Ubuntu require the package. Even with no custom rules loaded, login, authentication, and SELinux denial records may still exist; command execution and file-access events require rules. Detection content can map auditd telemetry to many ATT&CK techniques, including shell abuse, SSH key persistence, and sensitive-file permission changes.
Because auditd can capture process, file, permission, and account activity, improved access to its records could help administrators and incident responders reconstruct events and strengthen Linux monitoring. Organizations running Debian or Ubuntu may face visibility gaps if auditd is absent, making journal-based retrieval important. The root-only log restriction may limit who can investigate directly, so teams could need controlled export and review workflows. These factors may affect security operations, compliance evidence, and post-incident analysis, though outcomes depend on configuration and rule coverage.