Linux hosts

Linux audit events, triaged before anyone greps.

The collector streams the audit log and RootTrace triages events into failures, identity gaps, and privileged activity. One verdict banner says whether tonight needs eyes, and every count drills down to the raw events.

What RootTrace watches

Every reading is checked continuously; bad readings become grouped issues with the evidence attached. RootTrace also remembers whether it has seen the same incident before.

Audit event captureStreaming reads of the audit log with bounded batch sizes, built for busy hosts.
Optional STIG rulesA reviewed STIG audit ruleset can be enabled explicitly on RHEL 9/10, Rocky Linux, and CentOS Stream; it is never applied silently.
Signal triageEvents grouped into failures, identity gaps, and privileged activity with counts and last-event context.
Drill-downFrom any count to the underlying events, filterable by field and value.

Warn and fail thresholds, prefilled

Sensible defaults out of the box, overridable per host with environment variables. No threshold spreadsheet required on day one.

Capture bounds are configurable ROOTTRACE_LINUX_AUDIT_MAX_BYTES_PER_CYCLE
Enable / disable per host ROOTTRACE_LINUX_AUDIT_ENABLED

Setup

linux audit setup

# enabled with the standard install on supported distributions:
# after adding the signed RootTrace dnf or apt repository:
sudo dnf install roottrace-collector  # apt: sudo apt install roottrace-collector
sudoedit /etc/roottrace/collector.env  # set ROOTTRACE_COLLECTOR_TOKEN and API URL
sudo roottrace-collector-setup apply
sudo systemctl enable --now roottrace-collector

Read-only by architecture: no write path, no remediation executor, no inbound ports. Credential-like evidence is redacted before it leaves the host.

One collector, live in minutes

Everything on this page comes from the same read-only collector: one command per host, then point it at your targets.

install on any Linux host

$ # after adding the signed RootTrace dnf or apt repository:
sudo dnf install roottrace-collector  # apt: sudo apt install roottrace-collector
sudoedit /etc/roottrace/collector.env  # set ROOTTRACE_COLLECTOR_TOKEN and API URL
sudo roottrace-collector-setup apply
sudo systemctl enable --now roottrace-collector

Questions, answered honestly

Who is this for?

Teams that need audit visibility without building a SIEM pipeline first. The triage answers the CISO question ('did anything need eyes tonight?') while keeping raw events one click away for the operator.

Is this safe to run next to production?

The collector is read-only by architecture, not by policy: there is no write path, no remediation executor, and no privileged mode to switch on. It sends short-lived outbound HTTPS requests, opens no inbound ports, and redacts credential-like evidence before anything leaves the host.

Do I need a separate agent for this?

No. One RootTrace collector per host covers every integration on this site: databases, web servers, containers, endpoints, and the Linux host itself, all from one signed package or container. You point it at targets with environment variables; there is nothing else to deploy.

Free on 5 hosts. Live in minutes.

Create a workspace, install one collector, and watch issues explain themselves.

Create free workspace Schedule a demo