Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?

closed as too broad by Conor Mancone, Teun Vink, Tobi Nary, S.L. Barth, ThoriumBR Sep 10 '18 at 21:06

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


SELinux uses auditd for logging purposes, but auditd is independent from it. You can use auditd without SELinux present.

  • This is correct, but perhaps you could expand on how it works (e.g. how SELinux uses the audit subsystem, which auditd interfaces with). – forest Sep 6 '18 at 3:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.