juju deploy auditd
Discuss this charm
Share your thoughts on this charm with the community on discourse.
This subordinate charm installs and configures the auditd package.
The charm can be related to the nrpe or nrpe-external-master charm for a simple check to verify data is coming to the log.
The charm layer source.
The charm relates with any principal charm using juju-info interface. First deploy this charm, then relate it.
juju deploy auditd juju add-relation primary-charm auditd
A base configuration is included, additional_rules can be specified via the additional_rules configuration option or through the audit relation interface.
The audit relation needs more testing and possibly a interface layer to facilitate its use.
The auditd daemon requires special permissions and will not run in an unprivileged container.