# slackhq/go-audit

go-audit is an alternative to the auditd daemon that ships with many distros

Repository: https://github.com/slackhq/go-audit
Canonical: https://ross.abutalabs.com/products/go-audit
Language: Go
License: MIT
License Family: permissive
Last push: 2026-08-24T21:32:45+00:00

## Health v2 (maintenance only)
Score: 84/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 57, longevity 100
- inputs: {"age_days": 3583, "days_push": 9, "days_rel": 72, "gap_med": 193, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1664, forks 163 (observed 2026-08-28T04:05:18.944545+00:00)

## What it is
go-audit is a Go-based replacement for the auditd daemon that consumes Linux kernel audit events via netlink and outputs them as JSON. It supports pluggable output pipelines including syslog, local files, Graylog2, and stdout.

## Use cases
- replace auditd with a faster JSON-outputting audit daemon
- stream Linux kernel audit events to syslog or Graylog
- collect system call audit logs in JSON for a SIEM
- monitor file access and process execution on Linux servers
- build a custom audit log pipeline with pluggable outputs

## When to choose
- you want audit logs in JSON instead of auditd's raw format
- you need a lightweight, high-performance audit daemon that never blocks
- you want to forward kernel audit events to modern log pipelines like Graylog

## When to avoid
- you need full auditd/audisp plugin compatibility
- you are not running Linux, since it depends on the kernel audit netlink interface
- you require GUI-based audit rule management

## Facets
- artifact type: cli-tool
- maturity: active
- function: logging, monitoring, security, serialization
- domain: security, monitoring
- platform: go, cli
- tags: auditd, linux-audit, netlink, syslog, -logs, system-auditing, devops, command-line, linux

## Member repositories
- slackhq/go-audit (main) score 84

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:18.944545+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:44:30.013329+00:00, confidence not recorded.
  - readme: https://github.com/slackhq/go-audit (fetched 2026-08-28T04:05:18.944545+00:00, sha 90b1411061d8)
- Data as of 2026-08-30T08:39:29.467469+00:00.