auditunlink is a Linux shared library that intercepts the unlink system call, and logs which process, program, and user initiated it, and to which file the call was applied. It is designed to be loaded with LD_PRELOAD or /etc/ld.so.preload, and allows system administrators to log file deletions even if a user has the proper file system permissions to perform the deletion.
