The tag has no usage guidance.

learn more… | top users | synonyms

5
votes
1answer
296 views

How to log all system calls made by a process and all its descendants with auditd

I can do auditctl -a always,exit -S all -F pid=1234 To log all the system calls done by pid 1234 and: auditctl -a always,exit -S all -F ppid=1234 For its children, but how do I cover the ...
3
votes
1answer
31 views

How to exclude auditd messages from dmesg and only log them in /var/log/audit.log

I use audit to log suspicious user actions on a workstation in my institution. I found that, in addition to logging to /var/log/audit.log, auditd also writes to /var/log/messages. Consequently, ...
2
votes
1answer
456 views

How to audit access to any file or folder within a given path for specific user

I've been reading some information about configuration of auditd and I just can't figure this out, what I know how to do Log specific system calls by a user Log access to a specific file by all ...
2
votes
1answer
147 views

To be SOX compliant I need to keep years worth logs. Need help with particuliars

My company is going through an audit and I have taking over the role of Linux systems administrator unofficially. I see our current logging system has it to were we basically keep a months worth of ...
0
votes
1answer
153 views

automatically copy file from local server to remote server after login over ssh

I need to know how to copy a file from local server to remote server automatically after login using ssh. actually In my local server so many users are there with their local userid . but they will ...
0
votes
1answer
92 views

auditctl reports “File system watches not supported” on a very old system

When I run auditctl -l I got: # auditctl -l No rules File system watches not supported And I've already have AUDITSYSCALL enable in kernel, # zgrep AUDIT /proc/config.gz CONFIG_AUDIT_ARCH=y ...
3
votes
0answers
96 views

How to best track adventures of a novice administrator

I have this user that has limited sudo privileges, yet he manages to screw up from time to time. I would like to keep an eye on his adventures, so that I can reverse any damage with less digging. ...
3
votes
0answers
657 views

How to disable sudo related logging for successful command execution under CentOS/Fedora?

You can disable sudo related log messages via adding something like Defaults:juser !syslog to our sudoers file. That is disabling logging to syslog. But under e.g. CentOS/Fedora there is an auditd ...
3
votes
0answers
78 views

Is there a tool for seeing audit events as they happen without writing them to the disk?

Linux has an audit system that is usually used together with auditd, a daemon that, as far as I know, is designed for logging all events to the disk. However, I would like a way to directly get the ...
2
votes
0answers
24 views

Remote queue-like auditing service (“append-only pastebin”)

I am looking for an existing service / tool which would support the following in a UNIX-like shell environment: append-only writes, with writes guaranteed to be persistent for some well-specified ...
1
vote
0answers
17 views

How can I benchmark or audit an embedded kernel?

Is there a reliable or industry standard way to benchmark or audit embedded kernel performance? The target of the audit is to determine the time that the kernel spends in certain critical section, ...
1
vote
0answers
92 views

groupadd failure: “Cannot open audit interface”

I'm trying to add a group in a chrooted environment: root@my-host:/# /usr/sbin/groupadd -g 101 games Cannot open audit interface - aborting. I'm operating with root permissions. Additional info: ...
1
vote
0answers
619 views

tracking directory permission changes

Permission of a certain directory named 11203 got changed twice bcoz of which the hosted app encountered some problems. When i used the command.. ausearch -i |grep chmod |grep 11203 I got the ...
1
vote
0answers
197 views

File path in audit log instead of inode number

When I do: echo "#TEST" >> /etc/passwd I get the following in audit logging: node=kayak.office.local type=SYSCALL msg=audit(1412687666.054:62033): arch=c000003e syscall=2 success=yes ...
1
vote
0answers
120 views

What config changes are being tracked by aureport?

I am interested in using aureport to audit my server. When I run: # aureport -c It gives the following output: =================================== # date time type auid success event ...
1
vote
0answers
262 views

AIX auditing for LDAP users

I've discovered a problem with the way AIX uses auditclasses to determine which system calls are audited. If a user is defined in LDAP, their auditclasses attribute is blank. I found an APAR which ...
0
votes
0answers
22 views

Oracle Enterprise Linux (oel 7) blank screen

I ran these commands on my OEL system which resulted in a blank screen which I cannot access a command line or any GUI (KDE). The commands were: grep ebtables /var/log/audit/audit.log | audit2allow ...
0
votes
0answers
36 views

third party linux auditing software

Linux has a audit system built-in in its kernel and a user space process called auditd reading the system calls intercepted by the kernel. Are there alternate solutions to the Linux Audit system ? I ...