Enable auditing on Ubuntu

Ubuntu does not install or enable the audit daemon by default. Use this procedure to track security events and identify security violations.

Prerequisites

Configure the audit daemon

Update the package repository.
```
sudo apt update
```
Install the audit daemon and required plugins.
```
sudo apt install auditd audispd-plugins
```
Open the /etc/default/grub file in a text editor.
Add audit=1 to the GRUB_CMDLINE_LINUX parameter to enable auditing at startup.
Update the GRUB configuration and restart the endpoint.
Verify the status of the audit daemon.
```
sudo systemctl status auditd
```
List the active audit rules to confirm the kernel configuration.
```
sudo auditctl -l
```