auditd

auditd is a Linux utility that allows to retrieve audit records such as system-calls from the kernel

• apt install auditd

systemctl stop auditd
systemctl disable auditd

Related terms

• auditctl
• CIS Hardened Image Level 2

See also

• Auditd, auditctl, /var/log/audit/audit.log
• Audit: acct, atop, tripwire, AIDE, auditd, debsums, AWS Cloudtrail, logwatch, logcheck, Google Santa, Coguard
• Performance and troubleshooting

https://linux.die.net/man/8/auditd