In this lesson, you will learn how to configure the Linux audit system to generate a permanent log of which signals are sent between processes.
Why Track Signals?
Signals are the primary mechanism for asynchronous process communication and control (e.g., SIGTERM to stop a process or SIGHUP to reload a configuration). Because these events happen instantly, they are often invisible once they have occurred. By using the auditd subsystem, we can transform these transient signals into a persistent audit trail. This is vital for security auditing and debugging "mystery" crashes where a process terminates unexpectedly.
Configuring Signal Auditing
The Linux Audit Framework allows us to watch for the kill system call. Since almost all signals are delivered via system calls like kill, tkill, or tgkill, we can capture the identity of the sender and the target.
To set up a rule that records every signal sent by any user, you would use the auditctl command. Run the following command with root privileges:
# -a: append rule
# exit,always: log at the end of the system call
# -F arch=b64: specify 64-bit architecture
# -S kill: watch the kill system call
# -k signal_audit: attach a tag for easy searching
auditctl -a always,exit -F arch=b64 -S kill -k signal_audit
Once this rule is active, the kernel will monitor every kill system call. If a process sends a signal, the details—including the Process ID (PID) of the sender, the target PID, and the signal number—are written to /var/log/audit/audit.log.
Reviewing the Audit Trail
You can search the audit log using ausearch. To pull up the events tagged with signal_audit, use:
ausearch -k signal_audit
This output provides a historical account of process interaction. You will see fields like a0 (the target PID) and a1 (the signal sent). By correlating these logs with your process execution history, you can definitively prove which process initiated a shutdown or interruption, providing accountability in complex environments.
Key Takeaway: By attaching audit rules to the kill system call, you turn fleeting signal events into a searchable, permanent audit trail that reveals the "who, what, and when" of inter-process communication.