Configure Linux endpoints

Configure your Linux endpoints for use with the IBM® QRadar® Endpoint Content Extension.

About this task

System performances may be affected depending on the amount of information that is collected.


  1. Create a backup of the existing auditd rules configuration file by typing the following command:
    cp /etc/audit/rules.d/audit.rules /etc/audit/rules.d/audit.rules.bkp
  2. Edit /etc/audit/rules.d/audit.rules.
    1. Open /etc/audit/rules.d/audit.rules in vi by typing the following command:
      vi /etc/audit/rules.d/audit.rules
    2. Add the following rules at the end of the file:
      # Program called
      -a exit,always -F arch=b64 -S execve
      -a exit,always -F arch=b32 -S execve
      #It is possible to specify single commands to reduce the load with -F <path_to_binary> (see auditd documentation)
      # Process spawns child
      -a exit,always -F arch=b64 -S fork -S vfork -S clone
      -a exit,always -F arch=b32 -S fork -S vfork -S clone
      # File monitoring for edition and attributes modification	
      -w /boot -p wa
      -w /etc/pam.d -p wa
      -w /etc/shadow -p wa
      -w /etc/passwd -p wa
      -w /etc/rsyslog -p wa
      -w /etc/openldap -p wa
      -w /etc/sysconfig/syslog -p wa
      -w /etc/syslog.conf -p wa
      -w /etc/sysconfig/network-scripts -p wa
      -w /etc/default/ufw -p wa
      -w /etc/sudoers -p wa
      Tune the above list and correlation rules with files or directories that you wish to monitor.
  3. Restart the auditd service by typing the following command:
    service auditd restart