Auditd operates at the kernel level, so you have access to auditing any service you want. The auditd system is available for most Linux distributions, but I will demonstrate its usage on Ubuntu ...