RootTrace

Linux audit trail and compliance evidence

The collector can ingest Linux auditd events, and RootTrace turns them into two things: searchable incident context, and assessor-ready evidence for NIST SP 800-171 Rev. 3, CMMC Levels 1–3, DISA STIG/SRG-aligned OS audit requirements, and ISO/IEC 27001:2022 logging and record-protection controls.

The distinction matters throughout this guide. RootTrace collects and presents evidence. It does not assert that you are compliant.

How events get in

The collector parses key=value audit records, groups every record sharing one msg=audit(timestamp:serial) into a single event, and sends compact JSON batches to /api/collectors/linux-audit/ingest.

Two delivery paths, in order of preference:

AuditD realtime plugin (default). roottrace-collector-setup apply installs a RootTrace plugin in /etc/audit/plugins.d (or legacy /etc/audisp/plugins.d), running the packaged auditd-plugin.sh wrapper, so records arrive on auditd's stdin as they happen. The wrapper stays compatible with SELinux auditd_t: no log files, no state files, no bytecode writes, and a minimal host payload. Completed events flush every couple of seconds (ROOTTRACE_LINUX_AUDIT_PLUGIN_FLUSH_SECONDS), so a quiet host does not sit on events waiting for a batch to fill.

Log tailing (fallback). Rotation-safe tailing of ROOTTRACE_LINUX_AUDIT_LOG_PATHS, default /var/log/audit/audit.log, tracking device, inode, and offset. Used on hosts with no plugin directory.

Offsets advance only past batches the API acknowledged. A transient send failure re-sends those events on the next cycle instead of losing them.

Turning it on

Default onboarding enables linux_audit with these values:

ROOTTRACE_LINUX_AUDIT_ENABLED=true
ROOTTRACE_LINUX_AUDIT_LOG_PATHS=/var/log/audit/audit.log
ROOTTRACE_LINUX_AUDIT_BATCH_EVENTS=250
ROOTTRACE_LINUX_AUDIT_STREAMING=false
ROOTTRACE_LINUX_AUDIT_AUDITD_PLUGIN=true
ROOTTRACE_LINUX_AUDIT_STIG_RULES=false
ROOTTRACE_LINUX_AUDIT_RULES_DIR=/etc/audit/rules.d
ROOTTRACE_LINUX_AUDIT_PLUGIN_FLUSH_SECONDS=2
ROOTTRACE_LINUX_AUDIT_PLUGIN_MINIMAL_HOST=true
ROOTTRACE_SELINUX_NIS_ENABLED=true
ROOTTRACE_LINUX_AUDIT_RELOAD_AUDITD=true
ROOTTRACE_LINUX_AUDIT_MAX_BYTES_PER_CYCLE=4194304
ROOTTRACE_LINUX_AUDIT_INITIAL_LOOKBACK_BYTES=1048576
ROOTTRACE_LINUX_AUDIT_PRESERVE_RAW=true
ROOTTRACE_LINUX_AUDIT_RESOLVE_USERS=true
ROOTTRACE_LINUX_AUDIT_UID_CACHE_SIZE=4096

Leave ROOTTRACE_LINUX_AUDIT_STREAMING=false unless you have confirmed the API and proxy path accept chunked NDJSON uploads.

ROOTTRACE_LINUX_AUDIT_RESOLVE_USERS maps auid, uid, and euid back to real usernames through host NSS lookups, so LDAP, SSSD, AD, IPA, and local users all resolve when the host identity stack can resolve them. Without it you are reading numbers.

Kubernetes

Audit ingestion is disabled in the shipped DaemonSet, deliberately. Host audit logs are normally root-only and the collector pod runs as uid 65532. Enable ROOTTRACE_LINUX_AUDIT_ENABLED only in a site-specific overlay that grants that non-root identity explicit read access to the host audit log. Do not make the audit log broadly readable to satisfy the collector.

The STIG rule set, and why it is off

RootTrace ships the RHEL 9 STIG V2R8 audit rules for RHEL-family hosts: RHEL 9 and 10, Rocky Linux, CentOS Stream. They are off by default.

The reason is the last rule. The finalize file sets -e 2, which makes the running audit configuration immutable until the host reboots. After that, no later change reaches the live kernel rules, including turning this setting back off. Setting ROOTTRACE_LINUX_AUDIT_STIG_RULES=false removes RootTrace's rule files, but it cannot unload an already-immutable ruleset before a reboot.

Review the generated rules against your host's existing audit policy before opting in.

When enabled, the installers write reset, main, and finalize files under /etc/audit/rules.d/. Syscall rules are generated for the host's native audit architecture: unsupported syscall names are omitted, legacy names are covered by their native replacements (openat2, renameat2, fchmodat2, and similar), and every substitution or skip is printed in the install log. augenrules --check runs before loading, and on validation failure the installers remove the RootTrace-managed rule files rather than leave auditd with a broken ruleset.

Opt in per install method:

# Native packages: set this in /etc/roottrace/collector.env, then:
sudo roottrace-collector-setup apply

# Ansible:
ansible-playbook -i inventory.ini collector/ansible/install_roottrace_collector.yml \
  -e roottrace_collector_token=rtc_... \
  -e roottrace_linux_audit_stig_rules=true

What you get back

MongoDB stores the raw records plus parsed fields for actor, action, object paths, outcome, executable, syscall, audit key, host, and timestamps. Indexes are kept to a compact high-value set (time, host, actor, type, outcome, serial, and tokenized search terms) to bound memory use on high-volume fleets.

The Audit Trail page and GET /api/linux-audit/summary show incident posture, high-risk tooling, SELinux denials, audit configuration changes, framework coverage, timeline graphs, investigation leads, top real users, top event types, top audit keys, top hosts, recent failures, and recent audit changes.

GET /api/linux-audit/events supports sortable, tenant-scoped search by time, host, event type, outcome, real user, AUID/UID, executable, syscall, audit key, serial, and free text.

Framework coverage is computed in the summary and report responses rather than stamped onto every high-volume event.

Compliance evidence reports

Linux Audit Trail → Compliance Evidence Report. Pick a framework (NIST SP 800-171 Rev. 3, CMMC Levels 1–3, DISA STIG, or ISO/IEC 27001:2022) and a time window. View the evidence in the dashboard, or export an assessor-ready PDF:

GET /api/linux-audit/compliance-report?format=pdf

Each report states what evidence was captured and what remains a host or program responsibility. It never asserts compliance, because it cannot: final compliance still depends on system scope, host retention, review cadence, policy evidence, and assessor validation. What RootTrace removes is the part where somebody reconstructs six months of audit history by hand the week before an assessment.