How to Set Up Security Monitoring on Linux with auditd
Configuring the Linux audit daemon to watch specific files, commands, and syscalls, then actually query the resulting logs for something useful.
The kernel primitives, init systems, and tooling behind the world's most-deployed OS.
Configuring the Linux audit daemon to watch specific files, commands, and syscalls, then actually query the resulting logs for something useful.
Using bind mounts to expose one directory at multiple paths, and OverlayFS to layer a writable surface on read-only content — the base of containers.
Using bpftrace's scripting language to observe live kernel behavior — syscalls, function calls, scheduler events — with lower overhead than older tools.
Using systemd's resource-control unit directives to cap CPU, memory, and IO for a service, and confirming the kernel actually enforces them.
Packaging a kernel module with DKMS so it automatically rebuilds against every new kernel version, instead of breaking silently on the next kernel update.
Creating a separate network stack on the same machine to test firewall rules or networked software without touching the host's real network.
A complete walkthrough reading, changing, and persisting kernel runtime parameters — with a few of the most commonly tuned examples explained, not just listed.
Creating and running a lightweight systemd-nspawn container — useful for isolated testing environments without a full container runtime's overhead.
Understand io_uring queues, submissions, completions, workers, polling, resource registration, cancellation and security before benchmarking.
Linux 2.6.0 arrived on December 17, 2003 with preemption, O(1) scheduling, NPTL support, SELinux, ALSA and a modern device model.