Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?


SELinux uses auditd for logging purposes, but auditd is independent from it. You can use auditd without SELinux present.

| improve this answer | |
  • This is correct, but perhaps you could expand on how it works (e.g. how SELinux uses the audit subsystem, which auditd interfaces with). – forest Sep 6 '18 at 3:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.