Guix

auditd is the user-space component to the Linux auditing system, which allows logging of system calls made by user-land processes. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities. Configuring the audit rules is done with the auditctl utility.