<h1 id="audit-framework">Audit framework<a aria-hidden="true" class="anchor-heading icon-link" href="#audit-framework"></a></h1>
<p><abbr title="Controlled Access Protection Profile">CAPP</abbr>-compliant auditing system enabled by <code>CONFIG_AUDIT</code> available since 4.18. Configured in <code>/etc/audit</code> and can be monitored with <code>auditctl</code>.</p>
<hr>
<strong>Backlinks</strong>
<ul>
<li><a href="/notes/8b9fvou7s0huronxdwvgz6l">Auditbeat (public)</a></li>
</ul>

Audit framework


![Digital brain](assets/images/logo.svg){display: block, margin: 0 auto, max-height: 50vh}

Hi, I'm Luke 👋

I'm a software engineer turned site reliability engineer. I'm currently big on knowledge management and learning.

# Find me elsewhere

- [👨‍💻 DEV](https://dev.to/lukecarrier)
- [🚢 GitHub](https://github.com/LukeCarrier)
- [👔 LinkedIn](https://www.linkedin.com/in/lukecarrier/)
- [📄 Résumé](https://github.com/LukeCarrier/resume)
