The Linux platform owner refuses your auditd collection requirement on cost — now what?

## Why the refusal deserves respect A collection requirement is a bill sent to somebody else. Continuous syscall auditing on a Linux fleet has a real cost: measurable CPU on every host, disk on hosts that buffer locally, and ingest and storage volume that the platform or observability budget carries. The owner refusing is not obstructing security; they are protecting a service budget against a request whose benefit was stated as "a hunt would have been possible". If the ask cannot be justified in their terms, it deserves to lose. That framing is what changes the play. The question is not how to escalate, it is how to make the smallest ask that unblocks the most. ## Shrink the ask Most refusals are refusals of the *fleet-wide, everything-on* version. Almost every hunt needs less: - **narrower selection**: execution records, plus write coverage on the unit and cron directories — not a broad hardening ruleset imported wholesale; - **narrower host set**: the hosts that matter, defined by what runs on them rather than by convenience — a crown-jewel subset of a large fleet is often a small fraction of the cost; - **narrower duration**: a defined retention for those records, agreed rather than assumed. A request that has visibly been cut down reads differently from one that has not, and it gives the owner something to say yes to. ## Settle the overhead with a measurement The overhead argument is usually conducted between two people who have not measured it. End that. Propose a time-boxed pilot on a canary group of the owner's choosing, with the acceptance criterion written in advance and taken from **their** performance data, not yours. Two outcomes, both useful: the overhead is acceptable and the objection dissolves, or it is not and you have learned something true about that workload instead of arguing. Offering the owner control of the canary set and the criterion is also what converts the conversation from a demand into a shared experiment. ## Offer the cheaper substitute honestly Sometimes a weaker source answers most of the question at a fraction of the cost. A periodic inventory of unit files and cron entries collected through a configuration-management agent that is already deployed shows the *installation* of scheduled persistence, though not what it executed or when. Saying so — including saying what it does not cover — buys credibility for the times you insist the stronger source is genuinely required. Do not present a substitute as equivalent when it is not. ## Broaden the justification beyond your hunt One hunter's blocked hypothesis is a weak business case. The same missing records usually block a set of standing detections and any future investigation on those hosts, which is a different sentence: this portion of the fleet cannot be investigated after an incident, not merely hunted. If an audit or contractual obligation touches those systems, that belongs in the ask too. Bring the count of hosts and what runs on them, so the decision is about business exposure rather than about a security team's preference. ## If the answer is still no A refusal after a good-faith negotiation is a legitimate organisational outcome, and the security failure mode is to absorb it quietly. Instead: - **write it down as an accepted gap**, in whatever risk register the organisation actually uses, with the record type, the host set, the hunts and detections it blocks, and the consequence — that this segment cannot be searched for this technique class; - **name the accepting owner**, a person with the authority to accept it, not the security team; - **set a review date**, so the acceptance expires rather than becoming permanent by silence; - **change your own reporting**, so that hunts and detection-coverage summaries mark those hosts unhunted or uncovered rather than counting them as clean. This is the part with lasting effect: it removes the false assurance the organisation was getting for free. Then let the next event do the arguing. When an incident touches an uninstrumented host and the investigation stalls, the accepted gap you wrote down converts the conversation from blame into a decision that was made, by a named person, with a date. That is usually when the requirement gets funded — and the difference between a security team that looks prescient and one that looks obstructive is entirely whether the gap was recorded beforehand.