How to monitor the Mounting/Umounting of Mount Points Using Auditd on CentOS/RHEL 6,7?

Updated: 28 September 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9

auditd can record every mount and unmount, with the user who did it. These steps are for Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9 (install with dnf install audit or apt install auditd).

1. Check that auditd runs: systemctl status auditd.
2. Create /etc/audit/rules.d/mount.rules:

-a always,exit -F arch=b64 -S mount -S umount2 -k mount
-a always,exit -F arch=b32 -S mount -S umount -S umount2 -k mount
-w /usr/bin/mount -p x -k mount
-w /usr/bin/umount -p x -k mount

1. Load the rules: augenrules --load, and list them with auditctl -l.
2. Test it: mount and unmount something, then search the log: ausearch -k mount -i.

The -w lines also catch the mount command on newer systems (such as Ubuntu 24.04) that use the newer mount system calls. For a summary, run aureport -k.

Note: Rules in /etc/audit/rules.d/ survive reboots; rules added with auditctl alone do not.