auditd is a kernel demon that can snoop on users using your server. Can it be used on a Raspberry Pi?
I wanted to. The package exists in the RPi repo, but after installing, I can't add any rules to it. It always says:
Error sending add rule data request (Invalid argument)
I read about this on other forums, and this seems to be a kernel related problem. Or
Error detecting machine type
Even if I specify it with "-F arch=armv6l". So it seems, you can't, until these're fixed.