How to Use auditd to Monitor a Specific System Call

Updated: 28 September 2026 · Applies to: Linux audit 3.1 and 4.0 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10; auditd on Ubuntu 24.04 and 26.04 and Debian 13 (x86_64)

The audit system can record every call of a chosen system call, the low-level request a program makes to the kernel. This catches actions no matter which program performs them: loading kernel modules, mounting file systems, changing the clock or deleting files. This guide shows the rule syntax with a practical example taken from the sample rules that ship with the audit package (43-module-load.rules).

1. The rule format

-a always,exit -F arch=b64 -S SYSCALL[,SYSCALL...] [-F field=value ...] -F key=NAME

• -a always,exit: record the call when it returns.
• -F arch=b64: the 64-bit syscall table. Add the same rule with arch=b32 to cover 32-bit programs.
• -S: one or more system call names, separated by commas.
• -F: optional filters, for example auid>=1000 (only people who logged in, not system services), success=0 (only failed calls) or dir=/path.
• -F key=NAME: a label to search for.

2. Example: record kernel module loading

Create /etc/audit/rules.d/43-module-load.rules:

-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b64 -S delete_module -F key=module-unload
-a always,exit -F arch=b32 -S delete_module -F key=module-unload

Loading kernel modules is a common step for rootkits, so these rules are part of most security baselines. On AlmaLinux, Rocky Linux and RHEL you can also copy the file directly from /usr/share/audit/sample-rules/ (version 9) or /usr/share/audit-rules/ (version 10).

3. Load and search

augenrules --load
auditctl -l
ausearch -k module-load -i

Test with modprobe -r dummy; modprobe dummy: the load appears with the program and the user.

Find the right syscall names

ausyscall --dump | grep -i mount     # list syscalls matching a word
ausyscall x86_64 unlinkat            # check a name exists on this architecture

Names differ between architectures: for example stime exists only for 32-bit programs, and ARM64 systems have unlinkat but not unlink.

Keep the volume manageable

Rules on frequent system calls (such as open or read) can produce huge logs and slow the server. Always narrow them with -F filters, and watch the log size in /var/log/audit/.

More examples: who deleted a file, time changes and changes to /etc/passwd and /etc/shadow.

Official documentation: audit.rules manual page and auditctl manual page.