audit rules

A practical guide to configuring the Linux Audit System (auditd) on Fedora to monitor sensitive files like /etc/passwd and /etc/sudoers, and track user sudo commands. Covers writing persistent rules, analyzing logs with ausearch/aureport, and lessons learned from six months of production use.