How to Monitor System Time Changes with auditd

Updated: 28 September 2026 · Applies to: Linux audit 3.1 and 4.0 on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10 (x86_64); notes for Ubuntu and Debian

Someone changing the system clock can hide their tracks in the logs, break TLS and two-factor logins, or disturb scheduled jobs. Security standards such as PCI DSS and the STIG therefore require that clock changes are audited. The rules below come from the sample rule files that ship with the audit package itself (for example 30-stig.rules), in /usr/share/audit/sample-rules/ on version 9 and /usr/share/audit-rules/ on version 10.

1. Create the rules

Create /etc/audit/rules.d/30-time-change.rules:

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change
-a always,exit -F arch=b32 -S adjtimex,settimeofday,stime -F key=time-change
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
-w /etc/localtime -p wa -k time-change

The first four lines record the system calls that set or adjust the clock (a0=0x0 limits clock_settime to the real-time clock). The last line records changes of the time zone file.

2. Do not log chrony's normal adjustments

The time service adjusts the clock constantly, which would fill the log. On AlmaLinux, Rocky Linux and RHEL, the audit package includes a rule file that ignores these adjustments. Install it next to your rules:

cp /usr/share/audit/sample-rules/22-ignore-chrony.rules /etc/audit/rules.d/    # version 9
cp /usr/share/audit-rules/22-ignore-chrony.rules /etc/audit/rules.d/          # version 10

Its number (22) makes it load before your rules, so the chrony exception is checked first.

3. Load and check

augenrules --load
auditctl -l | grep time-change

4. Find clock changes

ausearch -k time-change -i
ausearch -k time-change -i --start today

Each event shows the program (exe=), the user who originally logged in (auid=) and the time. A manual date -s or timedatectl set-time appears here.

Ubuntu and Debian

Install auditd with apt install auditd and use the same rules. The chrony exception above relies on SELinux names and the chrony user of the Red Hat family, so on Ubuntu and Debian check first how many events chrony or systemd-timesyncd produce (aureport -k -i) before deciding whether to filter them.

Related: how to use auditd to find out who deleted a file.

Official documentation: audit.rules manual page and Auditing the system (Red Hat).