I enabled the auditd service using the following configuration to trace all user activities (belonging to group ID 555) on RedHat OS:

vim /etc/audit/audit.rules
-a always,exit -F gid=555 -F arch=b64 -S execve
-a always,exit -F gid=555 -F arch=b32 -S execve

vim /etc/audisp/plugins.d/syslog.conf
active = yes
args = LOG_LOCAL6

vim /etc/rsyslog.conf
local6.* @@<IP address>

However, for each executed command, several logs are generated (usually 3 logs), and there isn't any unique log that includes all necessary information, i.e.:

  • Command
  • Username
  • Timestamp
  • Server IP
  • Source IP

Is it possibile to configure auditd to write/forward just one log for each executed command? For instance, if user foobar runs rm -f /root/test.txt, the written/forwarded log should be something like this:

2017-05-10 10:14 <SourceIP> foobar@<DestinationIP> rm -f /root/test.txt

Thanks, Francesco

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.