Monitoring of Linux boot, reboot, and shutdown

1. Problem statement.

As part of fulfilling regulatory requirements, it was necessary to prepare an evidentiary base for auditors regarding monitoring of Linux operating system boot, reboot, and shutdown events.

This "Monitoring Note" presents the main conclusions obtained from practical testing of current releases of Linux operating systems: CentOS Stream 9/10 and Ubuntu Server 22.04/24.04/26.04 LTS.

2. General approach.

To monitor Linux boot, reboot, and shutdown, it is necessary to take into account the specifics of the particular operating system and version systemd. Depending on the presence of the component systemd-update-utmp either "" events ( Linux Audit "), or "" eventsSYSTEM_*), or "" events can be used. systemd/journal.

For a clearer presentation of the test results, all obtained results are presented as images created using AI.

3. Key events.

4. Event sequence.

5. OS-specific characteristics.

6. Additional audit of execution of reboot and shutdown commands.

Previously considered events Linux Audit SYSTEM_BOOT, SYSTEM_SHUTDOWN and SYSTEM_RUNLEVEL are generated by trusted user-space applications that support the "" interface (see p.5.2. Linux Audit Description and architecture of auditd ). To generate these events, separate file or system call watch rules are not required.To establish the user and the command that may have initiated a shutdown or reboot, OS state monitoring should be supplemented with auditing of execution of the corresponding programs. Such control is configured with "" rules and allows obtaining composite events with information about process start.

Example rules for watching execution of power management commands: Linux Audit Important

. Command execution is not equivalent to an actually performed reboot or shutdown. For example, "" in the "" record for "" means successful execution of the system call to start the program, not successful completion of the requested power management operation. Therefore, the command start event must be correlated with subsequent "" and "" events.

-w /usr/sbin/shutdown -p x -k power_exec
-w /usr/sbin/poweroff -p x -k power_exec
-w /usr/sbin/reboot   -p x -k power_exec
-w /usr/sbin/halt     -p x -k power_exec

Appendix. Brief information about the tested operating systems.Note success=yes . Presence of "" events depends on availability of the "" mechanism and is not guaranteed for all Linux releases. SYSCALL execve Linux Audit systemd

SYSTEM_* systemd-update-utmp