Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X.

Server X has auditd enables with rule: sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa

When events occur on Server X on that folder, it works great. However, when any other machines accesses or change anything nothing is reported. Server X and others have the same path. i.e /opt/WHATEVER

How can you enable auditd to track events from NFS?

share|improve this question

Much like recursion, in order to understand auditd you must first understand auditd. Auditd is the front-end to a kernel module that intercepts/monitors system calls and reports on them. That is to say, the -w option doesn't continuously perform an ls, md5sum, or similar on the target, it instructs the kernel module to report on attempts to perform file access calls, such as open() or creat(), on the target. Translating this information back to your question, this means that auditd can't detect changes being made by remote hosts in this way. Those system calls are occurring on the remote system.

To do the kind of monitoring you want you'll need to configure auditd on the remote hosts to monitor the nfs mount locally. What you should do then is log all the hosts running auditd to a central log host, using something like audisp-remote. Then the logs can be more easily searched and correlated.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.