AUDITD(8)

NAME
auditd - audit log management daemon

SYNOPSIS
auditd [-dhs]

DESCRIPTION
The auditd daemon responds to requests from the audit(1) utility and notifications from the kernel. It manages the resulting audit log files and specified log file locations.

The options are as follows:

-d  Starts the daemon in debug mode - it will not daemonize.

-h  Specifies that if auditing cannot be performed as specified, the system should halt (panic). Normally, the system will attempt to proceed - although individual processes may be stopped (see the -s option).

-s  Specifies that individual processes should stop rather than perform operations that may cause audit records to be lost due to log file full conditions

NOTE

To assure uninterrupted audit support, the auditd daemon should not be started and stopped manually. Instead, the audit(1) command should be used to inform the daemon to change state/configuration after altering the audit_control file.

Sending a SIGHUP to a running auditd daemon will force it to exit.

FILES
/var/audit
    Default directory for storing audit log files.

SEE ALSO
audit(1)