Audit Policies

<number>

Auditing is not set up by default in Ubuntu

There is a 3 step process for activating the Auditing function on Ubuntu

• Install the auditd application

sudo apt-get install auditd

• Enable the auditctl process

sudo auditctl –e 1

• Modify the auditd.conf file

sudo gedit /etc/audit/auditd.conf