Linux has an audit system that is usually used together with auditd, a daemon that, as far as I know, is designed for logging all events to the disk. However, I would like a way to directly get the events as output of a command. Is there a command that attaches to the kernel the same way auditd does, but then just prints the audit events to stdout or so instead of writing them to a file?
Is there a tool for seeing audit events as they happen without writing them to the disk?
linux;audit