Windows has EventID 1102 "The audit log was cleared". What is the equivalent audit event in Unix/Linux?
If someone has a sample event, and know what audit policy needs to be configured to get this event, please post that too.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
There's none: the audit log is a text-file which can be deleted. However if auditd is configured to run from the initial boot-up, auditd cannot be stopped, and will continue writing to its open file-descriptor. That would record the deletion if auditd were configured to watch its output log (though you'd have to recover the file to see the information).
Normally (on end-user systems), auditd is configured to record "security events" (login/logout), but can be told to watch files for changes. There's nothing specific to (for example)
/var/log/audit/auditd.log, but you can establish a watch for it as documented in the manual page.