Windows has EventID 1102 "The audit log was cleared". What is the equivalent audit event in Unix/Linux?

If someone has a sample event, and know what audit policy needs to be configured to get this event, please post that too.

  • What is "the security/audit log"? – Kusalananda Jul 26 '18 at 9:06
  • Are you looking for a definition for security/audit log? – tekybala Aug 1 '18 at 1:48
  • No, your question seems to imply that there is only one such log. – Kusalananda Aug 1 '18 at 6:08
  • Windows refers to all the logs in event viewer as 'Audit Log' – tekybala Aug 7 '18 at 0:56

There's none: the audit log is a text-file which can be deleted. However if auditd is configured to run from the initial boot-up, auditd cannot be stopped, and will continue writing to its open file-descriptor. That would record the deletion if auditd were configured to watch its output log (though you'd have to recover the file to see the information).

Normally (on end-user systems), auditd is configured to record "security events" (login/logout), but can be told to watch files for changes. There's nothing specific to (for example) /var/log/audit/auditd.log, but you can establish a watch for it as documented in the manual page.

Further reading:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.