Syscall Auditing with go-audit

This thread tracks the evolution of Slack's systems for monitoring and analyzing system calls (syscalls) on Linux production servers. Initial posts detailed the challenges of understanding outbound TCP connections and the processes/users initiating them. This post introduces go-audit, an open-source replacement for the userspace auditd daemon, designed to convert multiline audit events into single JSON blobs, speak directly to the kernel via netlink, and be highly performant. The goal is to enable centralized logging and alerting on syscall data for continuous monitoring, security analysis, and debugging, rather than filtering events on individual hosts.