Research

A Default Linux Audit Rule Can Silently Suppress File-Watch Capture

How a default -a never,task rule can suppress auditd file-watches, how we found it, and how defenders can check.

Sennin Security Labsv1.2October 20, 20264 min read

A plain-English, vendor-neutral method note for defenders. Linux's built-in audit subsystem (auditd, configured with auditctl) can be told to watch a file path and log changes to it. A default rule that ships on some systems can quietly stop those watches from ever firing. This note shows how we found that in our own testing and how you can check for it on your hosts. It makes no claim about any commercial EDR product.

A cloud provider's runtime threat-monitoring agent was also installed and running on the Linux lab host during these runs. It may log or act on activity independently of the tools described here. Its effect on these results was not tested.

Citation: the primary auditctl(8) manual describes -a never,task as “DISABLED BY DEFAULT” and states it makes every new process skip audit rule processing.

An unrelated scratch text file left on the host on October 15 sat on the host during both sessions; it was not executed, sat outside the test paths, does not affect the audit-rule restore result, and has since been archived and removed.

Before / after on one host

A cloud provider's runtime threat-monitoring agent was also installed and running on the Linux lab host during these runs. It may log or act on activity independently of the tools described here. Its effect on these results was not tested.

Rendered terminal output (redacted)

The frames below are rendered terminal output from masked transcripts (not live console captures). Bracketed tokens are redactions.

How defenders can check their own hosts

List your audit rules and look for a never,task entry above your watches; add a temporary watch on a scratch file with a known key, generate a known write, and search for it; then always remove the temporary watch. If the search shows the rule being added but no event for your write, a default never,task rule is the likely cause.

#!/usr/bin/env bash
# Defender self-check: is a default -a never,task rule suppressing your file-watches?
# Uses a harmless, lab-owned path. Always remove any temporary watch you add.
# 1) List the active audit rules and look for never,task
sudo auditctl -l | grep -n 'never,task' || echo 'no never,task rule listed'
# 2) Add a temporary watch on a scratch file with a known key
TESTKEY=audit_selfcheck
TESTFILE=/tmp/audit-selfcheck.$$
sudo auditctl -w "$TESTFILE" -p wa -k "$TESTKEY"
# 3) Generate a known write, then search for it
echo hello > "$TESTFILE"
sudo ausearch -k "$TESTKEY" --start recent
# 4) ALWAYS remove the temporary watch afterward
sudo auditctl -W "$TESTFILE" -p wa -k "$TESTKEY" 2>/dev/null || sudo auditctl -d always,exit -F path="$TESTFILE" -F perm=wa -k "$TESTKEY" 2>/dev/null
rm -f "$TESTFILE"
# If step 3 shows the CONFIG_CHANGE add_rule but NO PATH event for your write,
# a never,task rule above your watch is the likely cause (see auditctl(8), "DISABLED BY DEFAULT").

Limitations

• This is a single-host, cross-session result (five days apart), not a controlled A/B inside one session; the auditd package version is not pinned.
• It does not prove the default rule always suppresses watches, on every host or distribution.
• A cloud provider's runtime threat-monitoring agent was also installed and running on the Linux lab host during these runs. It may log or act on activity independently of the tools described here. Its effect on these results was not tested.
• It is a method note about host auditing only, and makes no claim about any commercial EDR product.

Methods and limitations

References

1. SSS-RC-2026-038 Part 01 Validation memo (VAL-01, claim 038-B)
2. auditctl(8) manual, 'DISABLED BY DEFAULT'

Want to know if your endpoint defenses still work?

We test them in your environment and give you a plain written answer.