This question already has an answer here:

I'm trying to gather audit logs using auditd.

Some says it needs to put parameter audit=1 to kernel cmdline, but I don't know where should I put the parameter.

Could anyone guide me on how to do this?

marked as duplicate by Zanna, vidarlo, karel, Eric Carvalho, David Foerster Apr 25 '18 at 12:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Oh that's what I looking for. my poor search ability. Thanks – mildonut Apr 25 '18 at 8:24
  • No problem! :) If it gives trouble, Instead of gksudo gedit, you can use sudoedit, sudo nano (or sudo <your-favourite-command-line-text-editor>), sudo -H gedit (or sudo -H <your-favourite-graphical-text-editor> – Zanna Apr 25 '18 at 8:24

Browse other questions tagged or ask your own question.