# systemctl status auditd.service
● auditd.service - Security Auditing Service
   Loaded: loaded (/lib/systemd/system/auditd.service; enabled; vendor preset: e
   Active: active (running) since Ср 2018-05-30 13:15:01 MSK; 1min 51s ago
  Process: 3349 ExecStartPost=/sbin/auditctl -R /etc/audit/audit.rules (code=exi
 Main PID: 3348 (auditd)
   CGroup: /system.slice/auditd.service
           ├─3348 /sbin/auditd -n
           ├─3352 /sbin/audispd
           └─3356 /sbin/audisp-remote

май 30 13:15:01 auditctl[3349]: No rules
май 30 13:15:01 auditctl[3349]: enabled 1
май 30 13:15:01 auditctl[3349]: failure 1
май 30 13:15:01 auditctl[3349]: pid 0
май 30 13:15:01 auditctl[3349]: rate_limit 0
май 30 13:15:01 auditctl[3349]: backlog_limit 320
май 30 13:15:01 auditctl[3349]: lost 0
май 30 13:15:01 auditctl[3349]: backlog 0
май 30 13:15:01 auditctl[3349]: backlog_wait_time 15000
май 30 13:15:01  systemd[1]: Started Security Auditing Service.

#
# This file controls the configuration of the audit daemon
#

#local_events = yes
log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 5
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file = 12
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
tcp_listen_port = 60
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key 

#
# This file controls the configuration of the audit remote 
# logging subsystem, audisp-remote.
#

remote_server = 127.0.0.1
port = 60
local_port = 60
transport = tcp
queue_file = /var/spool/audit/remote.log
mode = immediate
queue_depth = 2048
format = managed
network_retry_time = 1
max_tries_per_record = 3
max_time_per_record = 5
heartbeat_timeout = 0 

network_failure_action = stop
disk_low_action = ignore
disk_full_action = ignore
disk_error_action = syslog
remote_ending_action = reconnect
generic_error_action = syslog
generic_warning_action = syslog
overflow_action = syslog

##enable_krb5 = no
##krb5_principal = 
##krb5_client_name = auditd
##krb5_key_file = /etc/audisp/audisp-remote.key

#
# This file controls the configuration of the audit event 
# dispatcher daemon, audispd.
#

q_depth = 150
overflow_action = SYSLOG
priority_boost = 4
max_restarts = 10
name_format = HOSTNAME
#name = mydomain 

 # This file controls the audispd data path to the
# remote event logger. This plugin will send events to
# a remote machine (Central Logger).

active = yes
direction = out
path = /sbin/audisp-remote
type = always
#args = /etc/audisp/audisp-remote.conf
format = string