# Linux audit daemon (auditd) for system call logging The Linux audit daemon (auditd) provides a detailed and tamper-resistant logging mechanism for tracking specific actions on a Linux system, primarily by focusing on system calls, answering what action was taken, who performed it, when it occurred, and from where it originated, making it invaluable for forensic analysis after a security incident, provided it was enabled beforehand [3](#page=3).