I am writing a converter which takes Linux Audit logs as input. I tried to find the most recent dictionary file where all the valid names of the fields are defined.

I've found such a file[1] but the main website[2] says:


The specifications have moved to github. The following will be left in place for a while and then removed.

I cannot find these information on the GitHub Wiki[3] of the Linux Audit project.

Is the file[1] still the most recent and valid source of information?


  1. https://people.redhat.com/sgrubb/audit/field-dictionary.txt
  2. https://people.redhat.com/sgrubb/audit
  3. https://github.com/linux-audit/audit-documentation/wiki

From your github link, follow "Audit Event Parsing Library" which has a link the the dictionary at https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv

The raw CSV version is at


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.