Understanding One’s Systems: A New Role for Auditing

Auditing at the kernel level has frequently been used to debug the performance of operating systems and applications [27, 8] or to detect intrusions by finding anomalies in program behavior [20, 16]. This paper explores an alternative use of auditing to enhance understanding of system behavior and improve the processes of diagnosing and responding to failures. We describe our experiences with the auditing subsystem built into the Linux 2.6 kernel and present methods for correlating and interpreting the collected data in useful ways.