audit

Overview ¶

Package audit implements a persistent module which can read and parse the operating system audit trail. The module turns each audit event read from the kernel into a module alert, and writes it to the master agent process where the agent process can either write the audit event to it's log or send it to the dispatch module.

The audit module is currently only supported on Linux.