Artificial intelligent assistant

What is the Windows equivalent of 'Audit log cleared' event in Unix/Linux? Windows has EventID 1102 "The audit log was cleared". What is the equivalent audit event in Unix/Linux? If someone has a sample event, and know what audit policy needs to be configured to get this event, please post that too.

There's none: the audit log is a text-file which can be deleted. However if auditd is configured to run from the initial boot-up, auditd cannot be stopped, and will continue writing to its open file-descriptor. That would record the deletion if auditd were configured to watch its output log (though you'd have to recover the file to see the information).

Normally (on end-user systems), auditd is configured to record "security events" (login/logout), but can be told to watch files for changes. There's nothing specific to (for example) `/var/log/audit/auditd.log`, but you can establish a _watch_ for it as documented in the manual page.

Further reading:

* Linux audit files to see who made changes to a file

xcX3v84RxoQ-4GxG32940ukFUIEgYdPy 04344816c5860fc7ed0f11393f3e1448