{"id":18607,"date":"2026-07-13T20:26:02","date_gmt":"2026-07-13T16:56:02","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/security\/%d8%a2%d9%85%d9%88%d8%b2%d8%b4-%d9%86%d8%b5%d8%a8%d8%8c-%d9%be%db%8c%da%a9%d8%b1%d8%a8%d9%86%d8%af%db%8c-%d9%88-%d8%a7%d8%b3%d8%aa%d9%81%d8%a7%d8%af%d9%87-%d8%a7%d8%b2-auditd-%d8%af%d8%b1-%d9%84%db%8c\/"},"modified":"2026-07-13T20:35:13","modified_gmt":"2026-07-13T17:05:13","slug":"auditd","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/docs\/security\/auditd\/","title":{"rendered":"\u0622\u0645\u0648\u0632\u0634 \u0646\u0635\u0628\u060c \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0648 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Auditd \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u0627\u0646\u06cc\u062a\u0648\u0631\u06cc\u0646\u06af \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 <strong>Auditd (Linux Audit Daemon)<\/strong> \u0627\u0633\u062a. \u0628\u0631\u062e\u0644\u0627\u0641 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f RKHunter \u06cc\u0627 Chkrootkit \u06a9\u0647 \u0628\u0647 \u062f\u0646\u0628\u0627\u0644 Rootkit \u0648 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0647\u0633\u062a\u0646\u062f\u060c Auditd \u0648\u0638\u06cc\u0641\u0647 \u062b\u0628\u062a \u0648 \u06af\u0632\u0627\u0631\u0634 \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0631\u0627 \u0628\u0631 \u0639\u0647\u062f\u0647 \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627 Auditd \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0686\u0647 \u06a9\u0633\u06cc \u0641\u0627\u06cc\u0644\u06cc \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0686\u0647 \u06a9\u0633\u06cc \u0641\u0627\u06cc\u0644 \u0645\u0647\u0645\u06cc \u0631\u0627 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0686\u0647 \u0632\u0645\u0627\u0646\u06cc \u06cc\u06a9 \u06a9\u0627\u0631\u0628\u0631 \u0648\u0627\u0631\u062f \u0633\u06cc\u0633\u062a\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0686\u0647 \u062f\u0633\u062a\u0648\u0631\u06cc \u062a\u0648\u0633\u0637 \u06cc\u06a9 \u06a9\u0627\u0631\u0628\u0631 \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0686\u0647 \u0632\u0645\u0627\u0646\u06cc Permission \u06cc\u0627 Owner \u06cc\u06a9 \u0641\u0627\u06cc\u0644 \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0686\u0647 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a\u06cc \u0631\u0648\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644\u060c Auditd \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc <strong>Incident Response<\/strong> \u0648 <strong>Digital Forensics<\/strong> \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Auditd \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Auditd \u0633\u0631\u0648\u06cc\u0633 \u062b\u0628\u062a \u0648\u0642\u0627\u06cc\u0639 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u062a\u0645\u0627\u0645 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u062a\u0639\u0631\u06cc\u0641\u200c\u0634\u062f\u0647 \u0631\u0627 \u062b\u0628\u062a \u06a9\u0631\u062f\u0647 \u0648 \u0627\u0645\u06a9\u0627\u0646 \u062c\u0633\u062a\u062c\u0648 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0622\u0646\u200c\u0647\u0627 \u0631\u0627 \u062f\u0631 \u0622\u06cc\u0646\u062f\u0647 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img fetchpriority=\"high\" decoding=\"async\" width=\"783\" height=\"391\" src=\"http:\/\/maralhost.com\/kb\/wp-content\/uploads\/2025\/08\/cron-jobs.webp\" alt=\"ubunto cron jobs\" class=\"wp-image-17884\" style=\"width:431px;height:auto\" title=\"\" srcset=\"https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2025\/08\/cron-jobs.webp 783w, https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2025\/08\/cron-jobs-300x150.webp 300w, https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2025\/08\/cron-jobs-768x384.webp 768w\" sizes=\"(max-width: 783px) 100vw, 783px\" \/><\/figure>\n<\/div>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0646\u0635\u0628 Auditd<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Ubuntu \u0648 Debian<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\n\nsudo apt install auditd audispd-plugins -y\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">AlmaLinux \/ Rocky Linux \/ RHEL<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install audit audit-libs -y\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 \u0633\u0631\u0648\u06cc\u0633<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl enable auditd\n\nsudo systemctl start auditd\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0648\u0636\u0639\u06cc\u062a \u0633\u0631\u0648\u06cc\u0633<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl status auditd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0633\u0631\u0648\u06cc\u0633 \u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f\u060c \u0648\u0636\u0639\u06cc\u062a \u0622\u0646 \u0628\u0627\u06cc\u062f <strong>active (running)<\/strong> \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0646\u0633\u062e\u0647<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>auditctl -v\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0647\u0645 Auditd<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0627\u0635\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/audit\/auditd.conf\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0642\u0648\u0627\u0646\u06cc\u0646 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631\u06cc\u0646\u06af:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/audit\/rules.d\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644 \u0644\u0627\u06af:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/log\/audit\/audit.log\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0644\u0627\u06af\u200c\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0622\u062e\u0631\u06cc\u0646 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tail -100 \/var\/log\/audit\/audit.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo less \/var\/log\/audit\/audit.log\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0642\u0648\u0627\u0646\u06cc\u0646 \u0641\u0639\u0627\u0644<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo auditctl -l\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u0628\u062a\u062f\u0627\u06cc \u0646\u0635\u0628 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062e\u0631\u0648\u062c\u06cc \u062e\u0627\u0644\u06cc \u06cc\u0627 \u0634\u0627\u0645\u0644 \u0686\u0646\u062f \u0642\u0627\u0646\u0648\u0646 \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 \u062e\u0648\u0627\u0647\u062f \u0628\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u0641\u0627\u06cc\u0644<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0641\u0627\u06cc\u0644 SSH:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo auditctl -w \/etc\/ssh\/sshd_config -p wa -k ssh_config\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0627\u0631\u0627\u0645\u062a\u0631\u0647\u0627:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>w<\/strong> \u2192 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u0641\u0627\u06cc\u0644<\/li>\n\n\n\n<li><strong>p wa<\/strong> \u2192 \u062b\u0628\u062a \u0639\u0645\u0644\u06cc\u0627\u062a Write \u0648 Attribute Change<\/li>\n\n\n\n<li><strong>k<\/strong> \u2192 \u0646\u0627\u0645 \u0642\u0627\u0646\u0648\u0646 \u0628\u0631\u0627\u06cc \u062c\u0633\u062a\u062c\u0648\u06cc \u0622\u0633\u0627\u0646<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0631\u062f\u0646 \u0641\u0627\u06cc\u0644 passwd<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo auditctl -w \/etc\/passwd -p wa -k passwd_changes\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0631\u062f\u0646 \u0641\u0627\u06cc\u0644 sudoers<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo auditctl -w \/etc\/sudoers -p wa -k sudoers_changes\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0631\u062f\u0646 \u067e\u0648\u0634\u0647 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo auditctl -w \/var\/www\/html -p wa -k website\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0641\u0627\u06cc\u0644 SSH:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ausearch -k ssh_config\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 passwd:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ausearch -k passwd_changes\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u0627\u0645\u0631\u0648\u0632<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ausearch -ts today\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 Login \u06a9\u0627\u0631\u0628\u0631\u0627\u0646<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ausearch -m USER_LOGIN\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ausearch -m EXECVE\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u06cc\u06a9\u06cc \u0627\u0632 \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc\u200c\u062a\u0631\u06cc\u0646 \u0642\u0627\u0628\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc Auditd \u0627\u0633\u062a \u0648 \u0641\u0631\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u0627\u062c\u0631\u0627\u0634\u062f\u0647 \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0641\u0627\u06cc\u0644<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ausearch -f \/etc\/passwd\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062e\u0644\u0627\u0635\u0647 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo aureport\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06af\u0632\u0627\u0631\u0634 Login\u0647\u0627<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo aureport --login\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06af\u0632\u0627\u0631\u0634 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo aureport --auth\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06af\u0632\u0627\u0631\u0634 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo aureport --file\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06af\u0632\u0627\u0631\u0634 \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo aureport --exec\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062d\u0630\u0641 \u0642\u0648\u0627\u0646\u06cc\u0646 \u0645\u0648\u0642\u062a<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo auditctl -D\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062f\u0627\u0626\u0645\u06cc \u06a9\u0631\u062f\u0646 \u0642\u0648\u0627\u0646\u06cc\u0646<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0642\u0648\u0627\u0646\u06cc\u0646\u06cc \u06a9\u0647 \u0628\u0627 <code>auditctl<\/code> \u0627\u0636\u0627\u0641\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f\u060c \u067e\u0633 \u0627\u0632 \u0631\u06cc\u0628\u0648\u062a \u062d\u0630\u0641 \u062e\u0648\u0627\u0647\u0646\u062f \u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062f\u0627\u0626\u0645\u06cc \u06a9\u0631\u062f\u0646 \u0622\u0646\u200c\u0647\u0627\u060c \u0641\u0627\u06cc\u0644 \u062c\u062f\u06cc\u062f\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/audit\/rules.d\/custom.rules\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-w \/etc\/passwd -p wa -k passwd_changes\n-w \/etc\/sudoers -p wa -k sudoers_changes\n-w \/etc\/ssh\/sshd_config -p wa -k ssh_config\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 \u0642\u0648\u0627\u0646\u06cc\u0646 \u0631\u0627 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo augenrules --load\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u0633\u0631\u0648\u06cc\u0633 \u0631\u0627 \u0631\u06cc\u0633\u062a\u0627\u0631\u062a \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart auditd\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc\u06cc \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u062d\u062f\u0627\u0642\u0644 \u0627\u06cc\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0631\u0627 \u062a\u062d\u062a \u0646\u0638\u0631 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>\/etc\/passwd<\/code><\/li>\n\n\n\n<li><code>\/etc\/shadow<\/code><\/li>\n\n\n\n<li><code>\/etc\/group<\/code><\/li>\n\n\n\n<li><code>\/etc\/gshadow<\/code><\/li>\n\n\n\n<li><code>\/etc\/sudoers<\/code><\/li>\n\n\n\n<li><code>\/etc\/ssh\/sshd_config<\/code><\/li>\n\n\n\n<li><code>\/etc\/crontab<\/code><\/li>\n\n\n\n<li><code>\/var\/spool\/cron\/<\/code><\/li>\n\n\n\n<li><code>\/var\/www\/<\/code><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062a\u0641\u0627\u0648\u062a Auditd \u0628\u0627 AIDE<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">Auditd<\/th><th class=\"has-text-align-center\" data-align=\"center\">AIDE<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">\u062b\u0628\u062a \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u0646\u0645\u0627\u06cc\u0634 \u0627\u06cc\u0646\u06a9\u0647 \u0686\u0647 \u06a9\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0641\u0642\u0637 \u0648\u062c\u0648\u062f \u062a\u063a\u06cc\u06cc\u0631 \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u0645\u06cc\u200c\u062f\u0647\u062f<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u0645\u0646\u0627\u0633\u0628 \u062a\u062d\u0644\u06cc\u0644 \u062d\u0648\u0627\u062f\u062b<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0645\u0646\u0627\u0633\u0628 \u0628\u0631\u0631\u0633\u06cc \u06cc\u06a9\u067e\u0627\u0631\u0686\u06af\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062a\u0641\u0627\u0648\u062a Auditd \u0628\u0627 RKHunter<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">Auditd<\/th><th class=\"has-text-align-center\" data-align=\"center\">RKHunter<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">\u062b\u0628\u062a \u0641\u0639\u0627\u0644\u06cc\u062a \u06a9\u0627\u0631\u0628\u0631\u0627\u0646<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Rootkit<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u0645\u0627\u0646\u06cc\u062a\u0648\u0631\u06cc\u0646\u06af \u0644\u062d\u0638\u0647\u200c\u0627\u06cc<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0627\u0633\u06a9\u0646 \u062f\u0648\u0631\u0647\u200c\u0627\u06cc<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u062b\u0628\u062a \u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0628\u0631\u0631\u0633\u06cc \u0622\u0644\u0648\u062f\u06af\u06cc<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0641\u0642\u0637 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0647\u0645 \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0642\u0648\u0627\u0646\u06cc\u0646 \u063a\u06cc\u0631\u0636\u0631\u0648\u0631\u06cc \u0627\u06cc\u062c\u0627\u062f \u0646\u06a9\u0646\u06cc\u062f \u062a\u0627 \u062d\u062c\u0645 \u0644\u0627\u06af\u200c\u0647\u0627 \u0628\u06cc\u0634 \u0627\u0632 \u062d\u062f \u0627\u0641\u0632\u0627\u06cc\u0634 \u067e\u06cc\u062f\u0627 \u0646\u06a9\u0646\u062f.<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0644\u0627\u06af \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u062f\u0648\u0631\u0647\u200c\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0642\u0648\u0627\u0646\u06cc\u0646 \u0631\u0627 \u062f\u0631 \u0645\u0633\u06cc\u0631 <code>\/etc\/audit\/rules.d\/<\/code> \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0627\u0632 Auditd \u062f\u0631 \u06a9\u0646\u0627\u0631 AIDE\u060c Fail2Ban \u0648 RKHunter \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0631\u062f\u0646 \u06a9\u0644 \u0641\u0627\u06cc\u0644\u200c\u0633\u06cc\u0633\u062a\u0645<\/li>\n\n\n\n<li>\u0641\u0631\u0627\u0645\u0648\u0634 \u06a9\u0631\u062f\u0646 \u062f\u0627\u0626\u0645\u06cc \u06a9\u0631\u062f\u0646 \u0642\u0648\u0627\u0646\u06cc\u0646<\/li>\n\n\n\n<li>\u067e\u0631 \u0634\u062f\u0646 \u0641\u0636\u0627\u06cc \u062f\u06cc\u0633\u06a9 \u0628\u0647 \u0639\u0644\u062a \u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 \u0644\u0627\u06af\u200c\u0647\u0627<\/li>\n\n\n\n<li>\u062d\u0630\u0641 \u0644\u0627\u06af\u200c\u0647\u0627\u06cc Audit \u0628\u062f\u0648\u0646 \u062a\u0647\u06cc\u0647 \u0646\u0633\u062e\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 \u0647\u0634\u062f\u0627\u0631\u0647\u0627 \u0648 \u06af\u0632\u0627\u0631\u0634\u200c\u0647\u0627<\/li>\n<\/ul>\n\n\n<figure class=\"wp-block-post-featured-image\"><img decoding=\"async\" width=\"500\" height=\"304\" src=\"https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2025\/08\/logwatch-1.png\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"\" style=\"object-fit:cover;\" srcset=\"https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2025\/08\/logwatch-1.png 500w, https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2025\/08\/logwatch-1-300x182.png 300w\" sizes=\"(max-width: 500px) 100vw, 500px\" title=\"\"><\/figure>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06a9\u200c\u0644\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0633 \u0627\u0632 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc Auditd\u060c \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Auditd \u0646\u0635\u0628 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0642\u0648\u0627\u0646\u06cc\u0646 \u0645\u0648\u0631\u062f\u0646\u06cc\u0627\u0632 \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>\u0642\u0648\u0627\u0646\u06cc\u0646 \u062f\u0627\u0626\u0645\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/li>\n\n\n\n<li>\u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627 \u0628\u0627 <code>ausearch<\/code> \u0642\u0627\u0628\u0644 \u0645\u0634\u0627\u0647\u062f\u0647 \u0647\u0633\u062a\u0646\u062f.<\/li>\n\n\n\n<li>\u06af\u0632\u0627\u0631\u0634\u200c\u0647\u0627 \u0628\u0627 <code>aureport<\/code> \u062a\u0648\u0644\u06cc\u062f \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Auditd \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0628\u0631\u0627\u06cc \u062b\u0628\u062a \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0628\u0647 \u0634\u0645\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u062f\u0627\u0646\u06cc\u062f \u0686\u0647 \u06a9\u0633\u06cc\u060c \u0686\u0647 \u0632\u0645\u0627\u0646\u06cc \u0648 \u0686\u0647 \u062a\u063a\u06cc\u06cc\u0631\u06cc \u0631\u0648\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u06cc\u0627 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u062d\u0633\u0627\u0633 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a\u061b \u0642\u0627\u0628\u0644\u06cc\u062a\u06cc \u06a9\u0647 \u062f\u0631 \u0628\u0631\u0631\u0633\u06cc \u062d\u0648\u0627\u062f\u062b \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0641\u0648\u0630 \u0627\u0647\u0645\u06cc\u062a \u0628\u0627\u0644\u0627\u06cc\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u06a9\u0646\u0627\u0631 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f <strong>AIDE<\/strong>\u060c <strong>RKHunter<\/strong>\u060c <strong>Chkrootkit<\/strong> \u0648 <strong>Fail2Ban<\/strong>\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Auditd \u062f\u06cc\u062f \u0628\u0633\u06cc\u0627\u0631 \u062f\u0642\u06cc\u0642\u200c\u062a\u0631\u06cc \u0646\u0633\u0628\u062a \u0628\u0647 \u0648\u0636\u0639\u06cc\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0631\u0648\u0631 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0636\u0631\u0648\u0631\u06cc \u0628\u0631\u0627\u06cc \u0647\u0631 \u0645\u062f\u06cc\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0644\u06cc\u0646\u0648\u06a9\u0633\u06cc \u0628\u0647 \u0634\u0645\u0627\u0631 \u0645\u06cc\u200c\u0631\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u06cc\u0627\u0646 \u067e\u0648\u0631<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0645\u0642\u062f\u0645\u0647 \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u0627\u0646\u06cc\u062a\u0648\u0631\u06cc\u0646\u06af \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 Auditd (Linux Audit Daemon) \u0627\u0633\u062a. \u0628\u0631\u062e\u0644\u0627\u0641 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f RKHunter \u06cc\u0627 Chkrootkit \u06a9\u0647 \u0628\u0647 \u062f\u0646\u0628\u0627\u0644 Rootkit \u0648 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0647\u0633\u062a\u0646\u062f\u060c Auditd \u0648\u0638\u06cc\u0641\u0647 \u062b\u0628\u062a \u0648 \u06af\u0632\u0627\u0631\u0634 \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0631\u0627 \u0628\u0631 \u0639\u0647\u062f\u0647 \u062f\u0627\u0631\u062f. \u0628\u0627 Auditd \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f: \u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644\u060c Auditd \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc Incident Response \u0648 Digital [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":14575,"parent":17595,"menu_order":39,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-18607","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/c59fc140fa83b542ed78a005738a60da.jpg?ver=1786315553","author_name":"Shayan Kianpoor","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/18607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=18607"}],"version-history":[{"count":2,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/18607\/revisions"}],"predecessor-version":[{"id":18610,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/18607\/revisions\/18610"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17595"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/14575"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=18607"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=18607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}