Install ausyscall on Ubuntu 24.04

The ausyscall is a command line tool used to map system call names to their corresponding numbers and vice versa for the given architecture. It is especially useful when analyzing audit logs that reference system calls by number.

Install ausyscall

Run the following command to update package lists:

sudo apt update

The ausyscall tool is part of the auditd package, which provides user-space utilities for the Linux Audit subsystem. Install using this command:

sudo apt install -y auditd

Testing ausyscall

We can use ausyscall to list all syscall numbers and names for the current architecture as follows:

ausyscall --dump

Example output:

Using x86_64 syscall table:
0    read
1    write
2    open
3    close
4    stat
5    fstat
6    lstat

To view syscall tables for different architectures, specify the architecture explicitly:

ausyscall arm --dump

ausyscall aarch64 --dump

ausyscall riscv32 --dump

ausyscall riscv64 --dump

ausyscall s390x --dump

We can also look up a syscall by its number:

ausyscall 6

Output: lstat

Or look up a syscall by number for a specific architecture:

ausyscall arm 6

Output: close

Uninstall ausyscall

If you decided to completely remove ausyscall and related dependencies, use the following command:

sudo apt purge --autoremove -y auditd