The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

Enable auditing on Red Hat

  • Published on Aug 27, 2026
  • 1 minute(s) read
Prev Next

The audit daemon is enabled by default on Red Hat Enterprise Linux (RHEL). Use this procedure to verify the service status and list active rules for security tracking.

Prerequisites

  • You must have root privileges or sudo access.

  • The system must run RHEL version 7, 8, or 9.

Verify the audit daemon status

  1. Check the status of the audit service.

    sudo systemctl status auditd

  2. List the active audit rules to confirm the kernel configuration.

    sudo auditctl -l