auditd

This responds to requests from the audit utility and notifications from the kernel.
It should not be invoked manually.
More information.
auditd
auditd -d
auditd -l
Copyright © 2014—present the tldr-pages team and contributors.
This work is licensed under the Creative Commons Attribution 4.0 International License (CC-BY).
CC-BY