Source between audit and Syslog

Purpose of audit:

Records events at the core layer, reads and writes files, and calls from the system. Permission status

Belongs to the kernel

Syslog purpose:

Belongs to the application layer and records all application-layer error messages.

Audit has three operating tools

Three commands available for audit:

=> Auditctl-controls the kernel audit system, which can be used to retrieve, add, or delete rules, and set the watch for a specific case ).

=> Ausearch-the tool used to check the Audit audit logs.

=> Aureport-generate the audit system crash tool.

4. Set hosts

Audit is set to/etc/audit. Rules, which is divided into three types:

? Basic Audit System Parameters

? File and directory watches

? System Call audits

Source between audit and Syslog