This paper analyses the disadvantage of current Linux audit system, then an example using LKM is given to illustrat the realization of the function of auditing.

• 分析了当前审计系统的缺点,给出了一个利用可加载内核模块的方法实现审计功能的例子。