Guide: Configure auditd, log rotation and retention for LGPD compliance on Linux servers

By Kevin Marcondes · Published on Oct 28, 2026 · 8 min read

This guide shows how to configure auditd, log rotation and retention for LGPD compliance on Linux servers. You’ll find practical examples of audit.rules, auditd.conf parameters and safe retention policies focused on producing useful, reproducible evidence for audits and incidents — while respecting privacy and system performance.

LGPD in practice: what logs must prove

LGPD does not mandate specific tools, but it requires accountability. On Linux, auditd helps show who did what, when, from where and with which privilege. Focus on traceability, log integrity and retention proportional to purpose.

Think about objectives before creating rules. That avoids excessive data collection and reduces server impact.

• Traceability of privileged actions (root/sudo) and sensitive changes.
• Integrity and immutable or provable non‑tamper storage.
• Retention aligned with the purpose and legal basis.
• Restricted access to logs (least privilege).
• Ability to investigate incidents with reproducible searches and reports.

Prerequisites and minimal audit architecture

Define a simple, reliable architecture. Separate local collection, controlled rotation and trusted external storage. For general host hardening, use a broader checklist as a complement.

Correct time is crucial for correlation. Sync the server with NTP/Chrony. Plan disk space for peaks and retention.

For application logs and cross‑service correlation, centralization helps a lot.

• Root access and a kernel with audit support.
• Time synchronization (Chrony/NTP).
• Sufficient disk space on /var/log (ideally a dedicated partition).
• Log permissions 0600; access only for root.
• Optional: forward to a log concentrator or immutable storage.

Install and enable auditd on Linux

Install the audit daemon and enable it at boot. Then confirm the service status. Many distributions include a minimal default rule set; we’ll adjust rules and retention later.

# Debian/Ubuntu
sudo apt update && sudo apt install -y auditd audispd-plugins
sudo systemctl enable --now auditd
sudo systemctl status auditd --no-pager

# RHEL/CentOS/Rocky/AlmaLinux
sudo dnf install -y audit
sudo systemctl enable --now auditd
sudo systemctl status auditd --no-pager

# Ver parâmetros atuais do subsistema
sudo auditctl -s

Rotation and retention configuration in auditd.conf

The file /etc/audit/auditd.conf controls rotation, size and actions when disk is full. Set sizes compatible with your event rate. "rotate" avoids data loss; "suspend" pauses auditing until space is freed. Choosing "ignore" can cause evidence loss.

Adjust low‑space alerts and strict permissions. After editing, reload the service.

# /etc/audit/auditd.conf (exemplo)
log_file = /var/log/audit/audit.log
max_log_file = 200           # tamanho em MB por arquivo
num_logs = 12                # quantidade de arquivos rotacionados
max_log_file_action = rotate # rotate|keep_logs|suspend|ignore
space_left = 1024            # em MB: alerta quando restar 1 GB
space_left_action = SYSLOG   # SYSLOG|EMAIL|EXEC|SUSPEND
admin_space_left = 512       # ponto crítico
admin_space_left_action = SUSPEND
write_logs = yes
flush = INCREMENTAL_ASYNC
freq = 50
permissions = 0600
log_format = RAW

Audit rules aligned with LGPD: useful examples

Apply rules that provide useful evidence while keeping noise under control. Avoid auditing everything. Start with identity changes, privileges, authentication and directories containing personal data. An execve rule for all users can generate very high volume; filtering by euid=0 reduces noise.

Store your rules in /etc/audit/rules.d/lgpd.rules. We’ll load them with augenrules.

# /etc/audit/rules.d/lgpd.rules (exemplo)
# Tamanho do backlog do kernel (cautela conforme recursos)
-b 8192

# Integridade de arquivos críticos (identidades e privilégios)
-w /etc/passwd   -p wa -k ids
-w /etc/shadow   -p wa -k ids
-w /etc/group    -p wa -k ids
-w /etc/gshadow  -p wa -k ids
-w /etc/sudoers  -p wa -k sudo
-w /etc/ssh/sshd_config -p wa -k sshd

# Logins (varia por distro)
-w /var/log/lastlog  -p wa -k logins
-w /var/run/faillock -p wa -k logins

# Execução de comandos como root (64 e 32 bits)
-a always,exit -F arch=b64 -S execve -F euid=0 -k exec_root
-a always,exit -F arch=b32 -S execve -F euid=0 -k exec_root

# Diretório de dados pessoais da aplicação (ajuste o caminho)
-w /srv/app/dados_pessoais -p rwa -k lgpd_dados

Load the rules, generate evidence and reports

Load the rules and generate some test events. Use ausearch for detailed queries and aureport for summarized reports. Record the queries you’ll use in audits. Always validate in staging before applying to production.

# Carregar as regras
sudo augenrules --load
sudo systemctl restart auditd

# Gerar alguns eventos (ajuste conforme seu ambiente)
sudo -n true || echo "sudo requer senha" # aciona exec_root
sudo ls /root >/dev/null 2>&1 || true     # aciona exec_root
sudo usermod -c "Teste" $USER || true     # aciona ids

# Consultar por chaves específicas (human-readable)
sudo ausearch -k exec_root -ts today -i | head
sudo ausearch -k ids -ts today -i | head
sudo ausearch -k lgpd_dados -ts today -i | head

# Relatórios úteis
sudo aureport -au -i --summary     # autenticação/autorizações
sudo aureport -m  -i --summary     # mudanças de conta/identidade

Rotation with logrotate, safe retention and external custody

auditd rotates by size via auditd.conf. You can complement or harden this with logrotate for compression and retention by count/time. Keep permissions 0600 on files. Test rotation to avoid stopping the audit service.

For external custody and immutability, retention-locked objects (WORM) are an option. In cloud storage evaluate Object Lock. Centralization also aids search and correlation.

• Define retention period and legal basis for minimum necessary retention.
• Compress, version and store hashes independently from the files.
• Restrict access by roles; log accesses to the logs themselves.
• Consider immutable storage (WORM) and an external audit trail.
• Centralize logs for search and alerting.

# /etc/logrotate.d/auditd (exemplo)
/var/log/audit/audit.log {
    rotate 12
    size 200M
    missingok
    notifempty
    compress
    delaycompress
    create 0600 root root
    postrotate
        /bin/systemctl kill -s HUP auditd.service || true
    endscript
}

Best practices, performance and continuous verification

Collect the minimum necessary to meet the purpose. Avoid capturing file contents; focus on access and modification metadata. Control volume when adding execve rules. Measure events per minute and adjust the kernel backlog.

Ensure time sync and protect integrity: compute hashes and, when possible, sign batches. For application logs and cross‑service correlation, structured JSON centralization helps a lot.

Integrate auditing into security processes. For reactive authentication and lockouts, combine audit data with dedicated tools when appropriate. Maintain investigation runbooks.

Periodically verify everything is working. Simulate rotation and low‑disk scenarios in scheduled windows. Never run destructive tests in production without a rollback plan.

# Estado do daemon e parâmetros
sudo systemctl status auditd --no-pager
sudo auditctl -s

# Ver alguns eventos recentes da chave exec_root
sudo ausearch -k exec_root -ts recent -i | tail -n 10

# Testar configuração do logrotate (dry run)
sudo logrotate -d /etc/logrotate.d/auditd

# Conferir sincronização de tempo (se usar chrony)
chronyc tracking || timedatectl status

Frequently asked questions

How long should I retain logs for LGPD?

It depends on the purpose and legal basis for the processing. Define a written policy with clear retention periods and responsibilities. Security records often have longer retention than application logs. Avoid excessive retention. Review needs periodically and ensure secure disposal after the period.

Does auditd replace a SIEM?

No. auditd collects and stores local audit trails on Linux. A SIEM aggregates, correlates and alerts at scale. You can forward auditd events to a central system and integrate that with a SIEM for detection and response.

Will auditing execve for all users impact performance?

It can, because it generates high volume. Filtering by euid=0 reduces noise and cost. Measure event rates, daily log size and adjust backlog (-b), rotation size and rules. Test in staging and monitor CPU and I/O after changes.

Do I need to audit file contents that contain personal data?

Usually no. LGPD requires traceability and security, not copies of content. Auditing access and modification metadata is sufficient in most cases. Avoid excessive data collection. If content capture is truly necessary, use encryption and strict access controls.

How do I ensure log integrity for audits?

Use 0600 permissions, restrict administrative access and produce hashes (e.g., SHA‑256) of rotated files. Store hashes separately and, when possible, sign batches. Consider immutable (WORM) storage to prevent modifications and support chain of custody.

What to do if disk fills and auditing suspends?

Your policy should define actions: alerts, controlled deletion of old files per retention policy and service restoration. Configure space_left_action and admin_space_left_action for warnings and safe suspension. Monitor disk space and test rotation scenarios regularly.

See also

• Practical guide: active‑passive failover between two VPS with Keepalived, HAProxy & lsyncd for synchronized uploads
• Guide: technical checklist to prepare a Debian VPS with Docker Compose for PHP apps in production
• Practical guide to VPS sizing and PHP‑FPM tuning for Magento/OpenMage stores with seasonal peaks: from sizing to load testing
• Practical guide: rebuild PostgreSQL indexes in production using CREATE INDEX CONCURRENTLY and partial indexes (safe step‑by‑step)