The autrace man page summary is a little confusing:

This command deletes all audit rules prior to executing the target program and after executing it. As a safety precaution, it will not run unless all rules are deleted with auditctl prior to use.

The first sentence says autrace deletes the audit rules itself. The second sentence says autrace checks if any audit rules exist before running. They are contradictory.

The same confusion is seen elsewhere. How To Use the Linux Auditing System on CentOS 7 states that

running autrace will remove all custom auditing rules

which confirms the first sentence. The page goes on to explain that autrace fails if the audit rules are locked (immutable), which may explain the second sentence.

On the other hand, SUSE: Analyzing Processes with autrace states one must manually emit auditctl -D before running autrace.

Another point of contention between the two pages concerns the resulting autrace.log: the first page states it:

looks similar to the standard audit log entries

while the second states it:

does not look any different from the standard audit log entries.

Are the logs formatted the same or not?

A related issue: the ausearch man page states it:

can query the audit daemon logs

and provides --input and --input-logs options to query a specific log file (historical, imported, whatever) or the log file specified by auditd.conf, respectively. But the auditd and auditd.conf don't specify the default logging location. Linux audit – Log files /var/log/audit states the default location is /var/log/audit because that's the default value auditd.conf is created with. But that would make the --input-logs option pointless. So what is the default audit log location and how is it determined?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.