I have some lines of
auditd.log that contains the key
audit_cmd followed by a long string of HEX.
type=USER_CMD msg=audit(<TIMESTAMP>): pid=<PID> uid=<UID> auid=<AUID> ses=72940 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/<account>" cmd=2F62696E2F7368202D63206563686F204<HEX> terminal=pts/2 res=success'
How can I parse it?
Note: I might not be always on the machine that originally generated the logs (in some cases I look at logs already forwarded to an Elasticsearch server).