autrace man page summary is a little confusing:
This command deletes all audit rules prior to executing the target program and after executing it. As a safety precaution, it will not run unless all rules are deleted with auditctl prior to use.
The first sentence says
autrace deletes the audit rules itself. The second sentence says
autrace checks if any audit rules exist before running. They are contradictory.
The same confusion is seen elsewhere. How To Use the Linux Auditing System on CentOS 7 states that
running autrace will remove all custom auditing rules
which confirms the first sentence. The page goes on to explain that
autrace fails if the audit rules are locked (immutable), which may explain the second sentence.
On the other hand, SUSE: Analyzing Processes with autrace states one must manually emit
auditctl -D before running
Another point of contention between the two pages concerns the resulting
autrace.log: the first page states it:
looks similar to the standard audit log entries
while the second states it:
does not look any different from the standard audit log entries.
Are the logs formatted the same or not?
A related issue: the
ausearch man page states it:
can query the audit daemon logs
--input-logs options to query a specific log file (historical, imported, whatever) or the log file specified by
auditd.conf, respectively. But the
auditd.conf don't specify the default logging location. Linux audit – Log files /var/log/audit states the default location is
/var/log/audit because that's the default value
auditd.conf is created with. But that would make the
--input-logs option pointless. So what is the default audit log location and how is it determined?