The auditd daemon responds to requests from the audit utility and notifications from the kernel. It manages the resulting audit log files and specified log file locations.