auditd

Plan Kali logging from the event you need to retrieve, the effective collection setup and a bounded retention budget. Use a benign event and retrieval record to check coverage while preserving exclusions and sensitive-data limits.