slackhq/go-audit

Health v2 · maintenance only

Adoption not part of the score

1664 stars · 163 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

go-audit is a Go-based replacement for the auditd daemon that consumes Linux kernel audit events via netlink and outputs them as JSON. It supports pluggable output pipelines including syslog, local files, Graylog2, and stdout.

Use cases

• replace auditd with a faster JSON-outputting audit daemon
• stream Linux kernel audit events to syslog or Graylog
• collect system call audit logs in JSON for a SIEM
• monitor file access and process execution on Linux servers
• build a custom audit log pipeline with pluggable outputs

When to choose

• you want audit logs in JSON instead of auditd's raw format
• you need a lightweight, high-performance audit daemon that never blocks
• you want to forward kernel audit events to modern log pipelines like Graylog

When to avoid

• you need full auditd/audisp plugin compatibility
• you are not running Linux, since it depends on the kernel audit netlink interface
• you require GUI-based audit rule management

Facets

cli-tool · maturity active

logging monitoring security serialization security monitoring go cli auditd linux-audit netlink syslog -logs system-auditing devops command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="slackhq/go-audit")