Auditd

An auditd web UI for logs ausearch makes hard work

The Linux audit daemon records exactly what you ask it to and nothing more, which makes it the most precise tool on the server and the least pleasant to query. ausearch and aureport work, but they assume you already know what you are looking for and remember the flag that finds it.

This page shows the audit rules currently loaded, the paths and syscalls being watched, and the most recent events with their type, the process responsible and the outcome. Being able to see the loaded rules matters as much as seeing the events: an empty rule set is the most common reason auditd appears to be running but recording nothing of value.

A reasonable starting set watches /etc/passwd and /etc/shadow for changes, /etc/ssh/sshd_config for edits, and execution of privilege escalation binaries. Those four cover the traces most intrusions leave behind, without burying the log in noise from ordinary work.