Abstract: To achieve the goal of administrating mainframe and network safely, it is necessary to acquire various audit information in a Linux system completely. According to the mechanisms of Linux's loadable module and system call, the sources are analyzed and the method of getting audit information in Linux is determined. By constructing the kernel monitor module and record creating module, the aim in getting various audit information in a Linux system is achieved. Finally, the method of getting audit information of a system by customizing the kernel is demonstrated to be feasible and reliable, and the insufficiency of Linux's original log information is overcome.