// the take
A small C daemon from Romeus that uses the Linux auditd API directly (not log-tailing) to pull audit events, convert them to JSON with json-c, and forward them to a network listener. Reads like a take-home coding exercise for someone studying auditd internals and daemon-writing patterns, not a maintained tool.
Talks to the auditd API directly instead of scraping /var/log/audit/audit.log, which is the correct way to get events without racing log rotation. Uses json-c for serialization rather than hand-rolling JSON strings in C. Implements the baseline resilience requirement (daemonizes, restarts on failure) rather than just printing to stdout and calling it done.
Last commit is from 2017, one contributor, zero issues or forks - this is a dead one-off exercise, not something to build on. The brief calls for forwarding over an 'HTTP/2 API' but the actual test instructions just netcat a raw socket on port 8888, so there's no evidence a real HTTP/2 client path was ever implemented or exercised. The optional spec items - hiding the process from `ps`/the process list and resisting being killed by a non-root user - are rootkit-style behaviors; if present, that means you can't trivially audit or stop your own monitoring agent, which is a liability on any real host, not a feature. No TLS or auth on the network leg, so audit events (command lines, UIDs, paths) go out in clear text to whatever's listening. Target environment is CentOS 7 on a 3.10 kernel, both long past EOL.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →