# Auditing all Linux clients with centralised server

**URL:** <https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246>\
**Category:** SIEM\
**Tags:** elastic-stack-monitoring\
**Created:** [July 9, 2021, 7:23am UTC](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246 "2021-07-09T07:23:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaushalshriyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaushalshriyan/32/44563_2.png) [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\
**Post date:** [July 9, 2021, 7:23am UTC](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246/1 "2021-07-09T07:23:14Z")

</div>

Hi,

I have 20 Linux servers in the network. Is there a way to audit all Linux clients using a centralized server? For example, what commands are run by John on Linuxnode1? Steve on Linuxnode15? and so on and so forth to track user activity. Which files have been modified or edited or commands etc...... by the users.

I have installed auditd, but it is local to the Linux server. Thanks in advance.

Best Regards,

Kaushal

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [July 9, 2021, 8:10am UTC](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246/2 "2021-07-09T08:10:06Z")

</div>

What do you mean by "`I have installed auditd, but it is local to the Linux server`" ?

---

<div class="post-metadata">

**Author:** ![kaushalshriyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaushalshriyan/32/44563_2.png) [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\
**Post date:** [July 10, 2021, 5:31pm UTC](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246/3 "2021-07-10T17:31:37Z")

</div>

@ylasri Is there a way to push all audit logs to an Elastic Stack?. I am running Audit daemon on Centos by referring to [Linux System Monitoring and More with Auditd - Linux.com](https://www.linux.com/topic/desktop/linux-system-monitoring-and-more-auditd/)

Please suggest. Thanks in advance.

Best Regards,

Kaushal

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 10, 2021, 5:39pm UTC](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246/4 "2021-07-10T17:39:32Z")

</div>

You could use [auditbeat](https://www.elastic.co/beats/auditbeat) to collect the logs and send it to elasticsearch.

You can follow the documentation on how to install and configure [here](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-installation-configuration.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2021, 5:39pm UTC](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246/5 "2021-08-07T17:39:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.