Your auditd logs are a mess because you are missing the syscall filtering

Technical Briefing | 11/5/2026

I walked into a room yesterday where a colleague was trying to hunt down an unauthorized file modification. They had auditd running, but their log files were hundreds of gigabytes of pure garbage. They had enabled system-wide logging without narrowing their scope, effectively turning their audit daemon into a system performance killer that made finding the actual signal impossible. If your logs look like a firehose, you aren’t auditing, you are just burning disk I/O.

Stop the noise by pinning the syscalls

Most default auditd configurations just grab every file write attempt. That is a mistake. On a busy server, thousands of processes touch thousands of files every single second. You only care about the ones that matter, like your sshd configs or your web server root. You should be using the -S flag to lock onto specific system calls like unlink, rename, or chmod, instead of just watching every write event blindly.

auditctl -w /etc/shadow -p wa -k shadow_access_check

• Filter by uid to ignore root noise if you are debugging a specific user process
• Always use the -k key flag so you can actually grep your logs later
• Set an immutable flag at the end of your rules to prevent anyone from tampering with the audit configuration at runtime

The kernel audit subsystem is fast, but it is not infinite. If you start tracking every execve syscall without discretion, your performance will crater under load. Be surgical with your audit rules. Test them in staging first to see exactly how many events they generate per hour before you deploy them to production. If your audit logs are growing faster than your log rotation can handle, you have already lost the security battle.

Next time someone asks why the server is sluggish during a backup, don’t just blame the disk queue. Check if someone added a recursive audit rule on the entire /home directory. It is almost always a rule that is catching way more than the author intended.