System Setup and Software Installation Guide for Cisco NCS 1010, IOS XR Releases

PDF

System Setup and Software Installation Guide for Cisco NCS 1010, IOS XR Releases

AuditD process keepalive

Updated: September 11, 2026

Want to summarize with AI?

Log in

Explains how AuditD process keepalive events verify the liveness of the AuditD service and audit pipeline on NCS 1010, improving compliance, enabling early detection of silent failures, and supporting large-scale monitoring across distributed fleets.

AuditD process keepalive is a NCS 1010 capability that

  • verifies the health of the Linux AuditD service by periodically generating keepalive events

  • confirms that the audit logging path remains operational, and

  • provides a positive audit signal for compliance and early detection of silent failures.

Table 1. Feature History Table

Feature name

Release information

Feature description
AuditD process keepalive Cisco IOS XR 26.3.1

AuditD keepalive periodically generates an identifiable Linux audit event at a configurable interval between 10 and 43,200 minutes. Monitoring systems can use these events to verify AuditD health and detect interruptions in audit-event generation or delivery. Additionally, the feature provides automated syslog notifications for service state changes across all nodes.

This proactive monitoring eliminates silent failures, ensuring continuous compliance and enhanced operational visibility for large-scale deployments.

CLI keywords introduced:

The keywords keepalive and interval are added to the linux security audit command.

AuditD process keepalive

Starting with Release 26.3.1, NCS 1010 supports an AuditD keepalive capability. When you enable keepalive, the system periodically generates an identifiable Linux audit event at a user-configurable interval using the linux security audit keepalive interval interval command. This keepalive event verifies that AuditD process is running and the audit log forwarding remains operational, improving detection of silent failures and strengthening auditability across distributed system fleets.

AuditD process keepalive produces periodic, identifiable Linux audit events that act as heartbeat signals for monitoring systems, helping detect failures in audit-event generation or delivery.

AuditD process keepalive works independently of remote syslog forwarding. If remote syslog forwarding is enabled, NCS 1010 forwards keepalive events to the configured remote syslog server. If remote syslog forwarding is not enabled, NCS 1010 stores the keepalive events in the local audit log.

Each keepalive event is written to the AuditD log as an identifiable record. You can use this record to confirm that:

  • AuditD is running

  • the audit event path is working

  • audit events continue to reach the remote syslog server, if forwarding is enabled

Benefits of AuditD process keepalive

These are key benefits of the AuditD process keepalive:

  • Confirms AuditD liveness automatically without manual device checks.

  • Helps detect silent AuditD or log-pipeline failures earlier.

  • Supports large-scale monitoring across distributed system fleets.

  • Improves compliance verification by providing a positive audit signal.

  • Allows operators to configure hearbeat log frequency.

Guidelines for AuditD process keepalive

Follow these guidelines when deploying AuditD process keepalive:

  • Configure the keepalive interval in minutes. The supported range is 10 to 43200 minutes.

  • Filter on the audit_keepalive key in your monitoring tools so that you can identify keepalive events separately from operational audit events.

  • Use the location field in the audit log, when present, to identify the source node for a keepalive event. This field helps you distinguish events from different route processor, line card, sysadmin, or host locations.

  • Enable AuditD process keepalive explicitly. The feature is not active until you enable it.

Restrictions for AuditD process keepalive

Always remember these restrictions when deploying AuditD process keepalive:

  • AuditD process keepalive verifies AuditD liveness. It does not replace general device health monitoring.

  • Keepalive event delivery to a remote server depends on remote syslog forwarding being configured and operational.

  • If remote forwarding is not configured, the feature still generates keepalive events, but NCS 1010 stores them locally.

  • Verify platform and release availability before deployment.

Configure the AuditD process keepalive

Ensure NCS 1010 AuditD generates keepalive audit events at a configured interval and optionally forwards them to a remote syslog server for monitoring.

Use this task to maintain the integrity of audit logging by confirming periodic keepalive events. You can forward these events to a remote syslog server or store them locally for review.

Before you begin

  • Decide how often you want NCS 1010 to generate keepalive events.

  • If you want to forward keepalive events to a remote syslog server, configure the remote syslog destination on the system.

Follow these steps to configure AuditD process keepalive:

Procedure

  1. Enable AuditD process keepalive and set the interval.

    Example:

    RP/0/RP0/CPU0:ios# linux security audit keepalive interval 1010

    To disable AuditD process keepalive, use the no linux security audit keepalive interval 1010 command.

  2. Enable audit log forwarding.

    Example:

    RP/0/RP0/CPU0:ios# linux security audit logging syslog

  3. Configure the remote syslog destination.

    Example:

    RP/0/RP0/CPU0:ios#  logging 10.0.1.2 vrf default port 514
RP/0/RP0/CPU0:ios(config)# commit

  4. If you enabled remote forwarding, verify the forwarding status.

    Example:

    RP/0/RP0/CPU0:ios#  show linux security audit logging syslog
Mon Aug 10 10:18:01.703 IST
status: disabled            
syslog-server(s):
ipaddr: 10.0.1.2 vrf: vrf-default port: 514

  5. Confirm that keepalive events are generated:

    • Check on the remote syslog server if remote forwarding is enabled and the following syslogs are generated. 
      
#Audit configuration syslog
<182>1 2026-03-29T12:41:19.653359+05:30 NCS1020_B0_DT_01 SECURITY-AUDIT-6-EVENT - - - type=CONFIG_CHANGE msg=audit(1774768279.648:2200): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op=add_rule key="audit_keepalive" list=4 res=1#035AUID="unset”
	
#AuditD keepalive interval syslog
<182>1 2026-03-29T12:41:29.105188+05:30 NCS1020_B0_DT_01 SECURITY-AUDIT-6-EVENT - - - type=SYSCALL msg=audit(1774768289.101:2235): arch=c000003e syscall=87 success=yes exit=0 a0=7fe4a994a60c a1=7fe4a994a47b a2=1 a3=6 items=2 ppid=8348 pid=13338 auid=4294967295 uid=0 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="xr_auditd" exe="/opt/cisco/install-iosxr/base/bin/xr_auditd" subj=system_u:system_r:iosxr_t:s0 key="audit_keepalive"#035ARCH=x86_64 SYSCALL=unlink AUID="unset" UID="root" GID="iosxr" EUID="root" SUID="root" FSUID="root" EGID="iosxr" SGID="iosxr" FSGID="iosxr”
      Note

      By default, the syslogs are generated in /var/log/syslog/. Otherwise, the syslogs are generated in the path configured on the remote syslog server.

    • Check in the local audit log at /var/log/audit/audit.log if remote forwarding is not enabled.

NCS 1010 generates periodic keepalive audit events at the configured interval.

What to do next

Configure your monitoring system to alert when expected audit_keepalive events stop arriving for a device or location.