Enable auditing on SUSE

The audit package is installed by default on SUSE systems, but the service is not enabled. Use this procedure to activate the audit daemon and enable process auditing at startup.

Prerequisites

You must have root privileges or sudo access.

Configure the audit daemon

Enable and start the audit service.
```
sudo systemctl enable --now auditd
```
Open the /etc/default/grub file in a text editor.
Append audit=1 to the GRUB_CMDLINE_LINUX_DEFAULT variable.

Update the GRUB2 boot loader configuration.

sudo grub2-mkconfig -o /boot/grub2/grub.cfg

Restart the endpoint.
Verify the kernel command-line parameters.
```
cat /proc/cmdline
```
Verify the status of the audit daemon.
```
sudo systemctl status auditd
```
List the active audit rules to confirm the kernel configuration.
```
sudo auditctl -l
```