2

I have some lines of auditd.log that contains the key audit_cmd followed by a long string of HEX.

type=USER_CMD msg=audit(<TIMESTAMP>): pid=<PID> uid=<UID> auid=<AUID> ses=72940 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
msg='cwd="/home/<account>" cmd=2F62696E2F7368202D63206563686F204<HEX> terminal=pts/2 res=success'

How can I parse it?

Note: I might not be always on the machine that originally generated the logs (in some cases I look at logs already forwarded to an Elasticsearch server).

Improve this question
5
  • Can you post an extract of the data you are parsing
    – Raman Sailopal
    Commented Sep 6, 2017 at 11:27
  • No. I'm not sure what's on it (since I don't know how to parse it) and it might be a security risk to post it online
    – Tom Klino
    Commented Sep 6, 2017 at 11:28
  • 1
    found it: echo "<long hex string in audit_cmd section>" | xxd -r -p found in serverfault.com/a/673720/145823
    – Tom Klino
    Commented Sep 6, 2017 at 11:51
  • 1
    @TomKlino you should have considered the other easier answer in your link: ausearch -i to have the hex interpreted for you.
    – meuh
    Commented Sep 6, 2017 at 12:50
  • Yes. See the note I've written in the question as to why this is not an ideal solution for me
    – Tom Klino
    Commented Sep 6, 2017 at 13:19

1 Answer 1

Reset to default
1

I were running into the same question as I was collection auditd.log via SplunkUniversalForwarder and for investigation in Splunk.

As @Tom Klino already mentioned and discussed under auditd execve arguments looks like encoded data, the command string seems to be HEX encoded ASCII.

Therefore it would be possible to decode it via 

echo "<HEX encoded ASCII string>" | xxd -r -p

on the remote log collector (i.e. Splunk) later (and if xxd became installed with vim ).

A better approach for me seems to be to preprocess the log with ausearch -if audit.log -i and collect it with the Splunk app rlog.sh.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .