# go-audit

go-audit is a Security Information and Event Management product. It runs on-premises. Pricing is free.

An alternative to the auditd daemon with goals of safety, speed, JSON output, and pluggable pipelines connecting to the Linux kernel via netlink.

Checked October 2026.

## What is go-audit?

About go-audit is an alternative to the auditd daemon that ships with many distros. After having created an auditd audisp plugin to convert audit logs to json, I became interested in creating a replacement for the existing daemon.

Goals:
- Safe: Written in a modern language that is type safe and performant
- Fast: Never ever ever ever block if we can avoid it
- Outputs json: Yay
- Pluggable pipelines: Can write to syslog, local file, Graylog2, or stdout. Additional outputs are easily written.

Connects to the Linux kernel via netlink.

Usage:
- Installation: Install golang, version 1.14 or greater is required. Clone the repo, build the binary, and copy the binary go-audit to wherever you'd like.
- Testing: Run unit test suite, code coverage results, benchmark test suite, benchmark test suite with CPU profiling, and benchmark test suite with CPU profiling and GC collection.
- Running as a service: Check the contrib folder, it contains examples for how to run go-audit as a proper service on.

Tags: Linux

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Security Information and Event Management](https://cybersectools.com/categories/security-information-and-event-management-siem)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 1,661
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## go-audit FAQ

### What is go-audit?

go-audit is a product in the Security Information and Event Management category. It covers Linux.

### What is the pricing for go-audit?

go-audit is free. Download and setup instructions are at https://github.com/slackhq/go-audit/.

### What are alternatives to go-audit?

Alternatives to go-audit listed on CybersecTools:

1. [AWS CloudTrail](https://cybersectools.com/tools/aws-cloudtrail) - Track user activity and API usage on AWS and in hybrid and multicloud environments. (Commercial)
2. [Exabeam New-Scale Fusion](https://cybersectools.com/tools/exabeam-new-scale-fusion) - Security operations platform combining SIEM, UEBA, and SOAR capabilities (Commercial)
3. [Anomali Agentic SOC](https://cybersectools.com/tools/anomali-agentic-soc) - AI-driven SOC platform with unified data lake, threat intel, and automation (Commercial)
4. [CrowdStrike Falcon Next-Gen SIEM](https://cybersectools.com/tools/crowdstrike-falcon-next-gen-siem) - AI-native SIEM platform for consolidating security tools and data (Commercial)
5. [Senseon Intelligence Cloud](https://cybersectools.com/tools/senseon-intelligence-cloud) - AI-driven SIEM alternative with managed SOC for threat detection and response (Commercial)

Compare all go-audit alternatives at [https://cybersectools.com/alternatives/go-audit](https://cybersectools.com/alternatives/go-audit)

### What deployment and organization size does go-audit fit?

go-audit is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare go-audit with similar solutions

- [go-audit vs AWS CloudTrail](https://cybersectools.com/compare/aws-cloudtrail-vs-go-audit)
- [go-audit vs Exabeam New-Scale Fusion](https://cybersectools.com/compare/exabeam-new-scale-fusion-vs-go-audit)
- [go-audit vs Anomali Agentic SOC](https://cybersectools.com/compare/anomali-agentic-soc-vs-go-audit)

All alternatives to go-audit: [/alternatives/go-audit](https://cybersectools.com/alternatives/go-audit)

---

Source: https://cybersectools.com/tools/go-audit

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on go-audit: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md