I have some lines of auditd log that contains the key audit_cmd followed by a long string of hex. How can I parse it?

Note: I might not be always on the machine that originally generated the logs (in some cases I look at logs already forwarded to an elastic search server)

  • Can you post an extract of the data you are parsing – Raman Sailopal Sep 6 '17 at 11:27
  • No. I'm not sure what's on it (since I don't know how to parse it) and it might be a security risk to post it online – Tom Klino Sep 6 '17 at 11:28
  • found it: echo "<long hex string in audit_cmd section>" | xxd -r -p found in serverfault.com/a/673720/145823 – Tom Klino Sep 6 '17 at 11:51
  • @TomKlino you should have considered the other easier answer in your link: ausearch -i to have the hex interpreted for you. – meuh Sep 6 '17 at 12:50
  • Yes. See the note I've written in the question as to why this is not an ideal solution for me – Tom Klino Sep 6 '17 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.