Which two statements are true about the Linux Auditing System?

The Linux Auditing System (auditd) is a kernel-level framework for monitoring security-relevant events. Administrators can define rules to track specific activities. One common use is to create a "watch" rule on a sensitive file or directory, such as a user's home directory, which logs all access attempts, including those by the root user. Furthermore, the system operates by intercepting system calls. Defining rules that monitor frequently used system calls can generate a high volume of log data. The overhead of processing, filtering, and writing these events to disk can introduce a noticeable performance impact on the system, requiring careful rule configuration to balance security monitoring with system performance.

C. Permissive, enforcing, and disabled are operational modes for SELinux (Security-Enhanced Linux), not the Linux Auditing System.
D. This describes the function of a vulnerability scanner and a patch management system, which are separate from the event-logging purpose of the audit daemon.
E. This describes a security compliance scanning tool, like OpenSCAP, which uses policies and checks to perform on-demand scans, not the continuous, real-time event monitoring of auditd. ---

1. Red Hat Enterprise Linux 7 Security Guide

Chapter 10. System Auditing:

For Answer A: Section 10.3.2.2

"Watching File and Directory Access

" explains the use of the -w option with auditctl to monitor access to specific files and directories. It states

"The Linux Audit system enables you to watch files and directories." This directly supports logging access to a user's home directory.

For Answer B: Section 10.5.1

"Performance Considerations

" explicitly states: "The Audit system is designed to have a minimal overhead

but adding any kind of monitoring to a system will result in a performance impact... Defining too many Audit rules can slow down your system." This confirms the performance impact of extensive logging.

For Answer C: Chapter 9

"Managing Confined Services with SELinux

" Section 9.3.1

"SELinux States and Modes

" details the enforcing

permissive

and disabled modes as belonging to SELinux.

2. audit.rules(7) Linux man page:

For Answer A: The man page describes file system watches: "The second form of the rule is the file system watch. This is denoted by the -w option. This rule is used to watch a file or directory for access."

For Answer B: The man page details system call rules using -a or -A. The complexity and potential volume of these rules inherently imply a performance cost

a well-documented operational reality of system auditing.

3. Oracle® Linux 8: Monitoring and Tuning the System

Chapter 1. An Overview of System Monitoring and Tuning:

This document discusses various performance monitoring tools. While not directly about auditd

it reinforces the principle that intensive I/O and kernel-level processing

characteristic of heavy auditing

are primary factors in system performance degradation

supporting the logic for option B.