The tag has no usage guidance.

learn more… | top users | synonyms

3
votes
2answers
44 views

Protect session log from being written again by anyone

We have implemented a workaround to save command history in a new file for each user session for audit purpose. So each session file is identified by the start time and the username. The problem: The ...
1
vote
1answer
21 views

Where can I find the most recent dictionary of standard Linux Audit event fields?

I am writing a converter which takes Linux Audit logs as input. I tried to find the most recent dictionary file where all the valid names of the fields are defined. I've found such a file[1] but the ...
3
votes
1answer
91 views

Undocumented format of Linux Audit log records

I am writing a parser for Linux Audit and I stumbled upon some weird cases which doesn't seem to comply with the standard. My reference is the Red Hat's documentation. A proper audit record should ...
3
votes
1answer
36 views

Can I be sure that the name of a Linux Audit record's field is unique?

I am creating a parser/converter from the Linux Audit format. As I was studying the format, looking at examples and reading the documentation I stumbled upon a problem. Can I be sure that the field ...
1
vote
1answer
62 views

aureport interpretting report output

I have ran the following command on my RHEL 6 system to produce an audit report aureport --login --summary -i that produces the following output Login Summary Report ============================ ...
0
votes
0answers
23 views

Audit source cant able to run auditd

I have downloaded the audit-2.4.1-5.el7.src.rpm package, built, configured, performed make and make install steps. The auditd.service has been included in the systemd/system/ folder. Now, service ...
4
votes
1answer
167 views

How to exclude auditd messages from dmesg and only log them in /var/log/audit.log

I use audit to log suspicious user actions on a workstation in my institution. I found that, in addition to logging to /var/log/audit.log, auditd also writes to /var/log/messages. Consequently, ...
0
votes
0answers
61 views

Oracle Enterprise Linux (oel 7) blank screen

I ran these commands on my OEL system which resulted in a blank screen which I cannot access a command line or any GUI (KDE). The commands were: grep ebtables /var/log/audit/audit.log | audit2allow -...
1
vote
1answer
48 views

auditctl comm vs. exe

I was looking at Linux audit reports. Here is a log from ausearch. time->Mon Nov 23 12:30:30 2015 type=PROCTITLE msg=audit(1448281830.422:222556): proctitle=6D616E006175736561726368 type=...
1
vote
0answers
26 views

How can I benchmark or audit an embedded kernel?

Is there a reliable or industry standard way to benchmark or audit embedded kernel performance? The target of the audit is to determine the time that the kernel spends in certain critical section, ...
1
vote
3answers
98 views

Audit simultaneous logins in AIX

We are in a banking enviornment and our core system is based on AIX. Multiple users are logging in with the same userID at the same time using SSH. I know I can see who SSHed into the system from ...
1
vote
3answers
3k views

How to disable useless “audit success” log entries in dmesg

Short version: How to disable audit messages (dmesg) on a Fedora system? A Fedora system keeps logging "audit: success" messages in dmesg - in such an extreme way that dmesg has become unusable ...
2
votes
0answers
31 views

Remote queue-like auditing service (“append-only pastebin”)

I am looking for an existing service / tool which would support the following in a UNIX-like shell environment: append-only writes, with writes guaranteed to be persistent for some well-specified ...
3
votes
0answers
108 views

How to best track adventures of a novice administrator

I have this user that has limited sudo privileges, yet he manages to screw up from time to time. I would like to keep an eye on his adventures, so that I can reverse any damage with less digging. ...
2
votes
2answers
43 views

Is there a way to tell how a user authenticated their SSH connection ? i.e. whether it was by password or by public key?

I'm locking down my server to use public-key only. I just want to make sure before I flip the switch that all my users have already made the transition, and nobody is left using passwords to log in.
1
vote
0answers
171 views

groupadd failure: “Cannot open audit interface”

I'm trying to add a group in a chrooted environment: root@my-host:/# /usr/sbin/groupadd -g 101 games Cannot open audit interface - aborting. I'm operating with root permissions. Additional info: ...
2
votes
1answer
325 views

Password protecting Single User Mode and GRUB on a VPS

I have a VPS CentOS 6 Linux web server. It is run on KVM. Running a Lynis audit, it notes that single user mode and GRUB are not protected by any password/authentication: [16:00:28] Warning: No ...
2
votes
1answer
187 views

Non-root privileged user to find all files with SUID & SGID bit…Permission Required?

I'm writing an audit script to find all files with SUID & SGID bit set on the system, using the below command: find / perm /u=s,g=s The script will run with a non-root user. Will this user be ...
3
votes
1answer
162 views

How to find which process is currently writing to the disk?

For some unknown reason there is no space left on my /, even 5 minutes after removing 300 MBs of junk packages, there is no space left again. So I've come to conclusion that there is some process that ...
0
votes
2answers
46 views

Compare Linux configuration with default

My system fails to upgrade. I suspect it was breached. Is there a way to compare system configuration to default version that should be at this date and kernel version? My current system is Debian, ...
2
votes
1answer
1k views

How to audit access to any file or folder within a given path for specific user

I've been reading some information about configuration of auditd and I just can't figure this out, what I know how to do Log specific system calls by a user Log access to a specific file by all ...
2
votes
1answer
214 views

To be SOX compliant I need to keep years worth logs. Need help with particuliars

My company is going through an audit and I have taking over the role of Linux systems administrator unofficially. I see our current logging system has it to were we basically keep a months worth of ...
1
vote
0answers
1k views

tracking directory permission changes

Permission of a certain directory named 11203 got changed twice bcoz of which the hosted app encountered some problems. When i used the command.. ausearch -i |grep chmod |grep 11203 I got the ...
4
votes
0answers
981 views

How to disable sudo related logging for successful command execution under CentOS/Fedora?

You can disable sudo related log messages via adding something like Defaults:juser !syslog to our sudoers file. That is disabling logging to syslog. But under e.g. CentOS/Fedora there is an auditd ...
6
votes
1answer
480 views

How to log all system calls made by a process and all its descendants with auditd

I can do auditctl -a always,exit -S all -F pid=1234 To log all the system calls done by pid 1234 and: auditctl -a always,exit -S all -F ppid=1234 For its children, but how do I cover the grand-...
1
vote
0answers
239 views

File path in audit log instead of inode number

When I do: echo "#TEST" >> /etc/passwd I get the following in audit logging: node=kayak.office.local type=SYSCALL msg=audit(1412687666.054:62033): arch=c000003e syscall=2 success=yes ...
0
votes
1answer
185 views

automatically copy file from local server to remote server after login over ssh

I need to know how to copy a file from local server to remote server automatically after login using ssh. actually In my local server so many users are there with their local userid . but they will ...
1
vote
1answer
513 views

Who is user “unset” in aureport?

I couldn't find this elusive "unset" user in /etc/passwd and there is no mention of him in man aureport although she scored the most number of hits on my audit log: # aureport -u -i --summary --start ...
0
votes
0answers
42 views

third party linux auditing software

Linux has a audit system built-in in its kernel and a user space process called auditd reading the system calls intercepted by the kernel. Are there alternate solutions to the Linux Audit system ? I ...
2
votes
1answer
147 views

How to extract a list of user accounts deleted from the system over a period of 1 year? [closed]

I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
6
votes
1answer
3k views

Why do I get “Permission Denied” errors even though I have group permission?

I'm trying to run a game called "Dofus", in Manjaro Linux. I've installed it with packer, that put it under /opt/ankama folder. This folder ownership (and for every file inside it) is root user, and ...
3
votes
1answer
61 views

Recover atime after vim

I've vimed a file, and only afterwards realised that I need the atime (last access time) for the file. Is there any way to recover the atime for a file after accessing it inadvertently? The ...
2
votes
1answer
255 views

Unix Useradd - Audit list of users added to system [duplicate]

I would like to understand how could I pull out a list of users that have been added with certain privileges to a Unix system over a certain period of time. Now, I understand one way to go about ...
2
votes
1answer
2k views

Bandwith Usage in OpenVPN

Is there any way to check how much bandwidth a user used in OpenVPN (using PAM Authentication)
1
vote
0answers
146 views

What config changes are being tracked by aureport?

I am interested in using aureport to audit my server. When I run: # aureport -c It gives the following output: =================================== # date time type auid success event ==============...
6
votes
2answers
363 views

How do I view executables run by a program?

Is there a way to view or get a list of executables that a program uses? A particular example is file-roller. Is there a way to see which executables it uses, if there is more than one executable it ...
4
votes
1answer
2k views

Monitoring Linux user activities and auditing them

var/log/secure provides us below information : Mar 20 08:07:07 testing sshd[29749]: Accepted password for oracle from 10.51.1.12 port 49239 ssh2 Mar 20 08:07:07 testing sshd[29749]: pam_unix(sshd:...
2
votes
2answers
412 views

is there a audit tool to track package installs and kernel version

I'm currently diagnosing a problem that started about a week ago on my laptop (running Ubunutu). The exact issue is not relevant though. Because I was already running several locally built kernel ...
1
vote
1answer
16k views

(CentOS) default FTP (SFTP) Log File?

I'm on CentOS v6.4 and using its native FTP Server, which i suppose is sftp. (Am i right?) Now i can use FTP well. But i need to log the actions taken by Users. Logs for the actions, such us, who ...
2
votes
3answers
2k views

dmesg filled with audits every minute from cron

My dmesg is filled with output of like the following, starting from a couple of seconds after booth and continuing indefinitely: [ 3155.216230] type=1006 audit(1393236841.859:85): pid=4206 uid=0 old ...
6
votes
1answer
221 views

audit activity on abstract domain sockets?

Using the audit system (auditd, auditctl) on Linux, is it possible to log connections to Unix domain sockets on the abstract namespace (or more exactly to filter them based on the (abstract) path)? ...
4
votes
2answers
9k views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
3
votes
1answer
2k views

Root complete history commands

Where can I get root's history except besides .sh_history? I've gotten some information but only from .sh_history and the history command.
6
votes
1answer
219 views

Automatic logging of scripts executed by users

That's a recurrent question of my workmates. We are a team of many people which works in the same Unix and Linux servers. The recurrent questions is if there are a log or something similar by default ...
1
vote
2answers
677 views

How to determine what user was used to start Apache Tomcat last (or last few times)

On a Mac, or a Linux Tomcat install, how do I determine what user was used last to start Tomcat? Is there information in the logs somewhere to that effect? Assume that startup.sh and shutdown.sh are ...
4
votes
2answers
782 views

How to interpret the “saddr” field of an audit log?

I'm trying to log the parameter of connect, so I added one rule with auditctl. Now in audit.log I get lines like this: type=SOCKADDR msg=audit(1385638181.866:89758729): saddr=hex string So how ...
0
votes
1answer
112 views

auditctl reports “File system watches not supported” on a very old system

When I run auditctl -l I got: # auditctl -l No rules File system watches not supported And I've already have AUDITSYSCALL enable in kernel, # zgrep AUDIT /proc/config.gz CONFIG_AUDIT_ARCH=y ...
5
votes
1answer
134 views

How do I find the full history of a file?

I need to know the full history of a file, like if someone changed or moved it to some other places since the time when it is created.
5
votes
0answers
97 views

Logging violations of rules in limits.conf [duplicate]

I'm trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
1
vote
1answer
319 views

Is there a way to see which process invoked a shell script?

Is there a possibility so see from some unix log file what process have invoked a bash/ksh shell script or is this shell script invoked manually from command line? So is there some log file which ...