The audit daemon, auditd, operates as a server, monitoring /dev/audit for local audit data, monitoring a known port for data from remote cooperating audit daemons, and monitoring an AF_UNIX socket for input from the system administrator.