1
vote
0answers
12 views

File path in audit log instead of inode number

When I do: echo "#TEST" >> /etc/passwd I get the following in audit logging: node=kayak.office.local type=SYSCALL msg=audit(1412687666.054:62033): arch=c000003e syscall=2 success=yes ...
0
votes
0answers
19 views

third party linux auditing software

Linux has a audit system built-in in its kernel and a user space process called auditd reading the system calls intercepted by the kernel. Are there alternate solutions to the Linux Audit system ? I ...
3
votes
1answer
376 views

Monitoring Linux user activities and auditing them

var/log/secure provides us below information : Mar 20 08:07:07 testing sshd[29749]: Accepted password for oracle from 10.51.1.12 port 49239 ssh2 Mar 20 08:07:07 testing sshd[29749]: ...
2
votes
0answers
82 views

audit activity on abstract domain sockets?

Using the audit system (auditd, auditctl) on Linux, is it possible to log connections to Unix domain sockets on the abstract namespace (or more exactly to filter them based on the (abstract) path)? ...
5
votes
1answer
106 views

How do I find the full history of a file?

I need to know the full history of a file, like if someone changed or moved it to some other places since the time when it is created.
5
votes
0answers
96 views

Logging violations of rules in limits.conf [duplicate]

I'm trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
3
votes
1answer
1k views

Is there an easy way to log all commands executed, including command line arguments?

I am trying to find how to log a specific instantiation of rrdtool to see whether the path it is receiving is incorrect. I know I could wrap the executable in a shell script that would log the ...
3
votes
0answers
64 views

Is there a tool for seeing audit events as they happen without writing them to the disk?

Linux has an audit system that is usually used together with auditd, a daemon that, as far as I know, is designed for logging all events to the disk. However, I would like a way to directly get the ...
4
votes
2answers
229 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
1
vote
2answers
96 views

Auditing Linux: tell me to what IPs a connection was established

I need a command, or something that runs as a cron job, that logs what IPs my machine is communicating with, what ports, and what process did it.
3
votes
2answers
368 views

Proper syntax for “id -r” command

I'm trying to see if id -r will print out the UID or username of the user who logged into the system despite any su's or sudo's. I'm interested in doing this so I can keep people a little more ...
0
votes
1answer
24 views

Auditing of gdb commands

Is there a way I can log all gdb commands executed by a user? And do user level logging? Is any other tool like gdbserver can help in this case ?
6
votes
2answers
815 views

Is it possible to know who visited my home directory?

Suppose there are many users in a Linux cluster, each of them has his own HOME directory under /home/xxx, with xxx being his user name (or account). If the initial system configuration allows these ...
3
votes
2answers
9k views

Display a file's history (list of users that have modified a file)

Is there a command to display a list of users who modified a file providing a file history? I know that possible with svn/git etc.. but we have a config file that is not in SVN and someone modified ...
4
votes
1answer
511 views

Commands for Auditing Installed Software

Similar to the question here, http://serverfault.com/questions/387111/inventory-or-audit-installed-linux-software, I would like to obtain ideas about commands that should be ran across various ...