Linux Audit Daemon (auditd) Rules

Distro support

Two-family skill. auditd is the same daemon on both families — same auditctl syntax, same /etc/audit/rules.d/*.rules, same ausearch / aureport. Only the package step and the source of pre-built compliance rulesets differ. The RHEL family additionally surfaces SELinux AVC denials through the same audit log, so ausearch -m AVC is a RHEL-side bonus signal. Body uses Debian/Ubuntu; substitute per this matrix.