Linux-audit Archive on
 help / color / Atom feed
From: Steve Grubb <>
To: "" <>
Subject: Re: systemd daemon and auid
Date: Wed, 07 Apr 2021 09:23:01 -0400
Message-ID: <5450942.DvuYhMxLoT@x2> (raw)
In-Reply-To: <>

On Wednesday, April 7, 2021 3:20:22 AM EDT MAUPERTUIS, PHILIPPE wrote:
> I understand that daemons started by systemd have a uid -1.
> For a specific daemon, I would like to have a different auid to trace what
> the daemon is doing. By having a distinct auid it would be monitored
> without specific rules. Is that possible ?

While it may be possible, that violates how the audit system was designed to 
operate. Setting the loginuid also sets the session ID. The utilities look 
for those events to determine that a login has occurred and then track that.

> Otherwise what would be the best way to monitor a specific daemon ?

There is auditing by application.

-a always,exit -F exe=/usr/sbin/httpd  -F arch=b64 -S open,openat, ...


Linux-audit mailing list

      reply index

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-07  7:20 MAUPERTUIS, PHILIPPE
2021-04-07 13:23 ` Steve Grubb [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5450942.DvuYhMxLoT@x2 \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-audit Archive on

Archives are clonable:
	git clone --mirror linux-audit/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-audit linux-audit/ \
	public-inbox-index linux-audit

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone