auditd baseline

sudo auditctl -R /etc/audit/rules.d/audit.rules

Load the full set of audit rules from the baseline file, ensuring homogeneous coverage across all hosts.

Run it when deploying or restoring a host's audit policy: auditctl -R loads all rules from the file at once, instead of one by one. The baseline (the audit.rules file with file monitoring, syscalls, and authentication rules — typically from CIS Benchmark or the organization's hardening) is what ensures all hosts audit the same. In a managed fleet, reloading with -R after a policy change is the deployment step, and verifying with auditctl -l that it loaded is the quality check.

Don't use it without reviewing the file content: loading a baseline with poorly written or overly broad rules can flood the audit log (and the SIEM) or block boot if loaded from /etc/audit/rules.d at startup. On hosts with tight performance, the full syscall baseline has a cost — evaluate which rules are unnecessary for that host. And beware: auditctl -R loads rules on the fly, but if the file isn't in /etc/audit/rules.d/, a reboot loses everything — persistence is part of the configuration, not the command.