0

How to Extract audit.log

While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed at shell).

Audit.log as follows:

> type=SYSCALL msg=audit(1554390377.124:5): arch=40000003 syscall=11
> success=yes exit=0 a0=810cf88 a1=810bd88 a2=80f5008 a3=810bd88 items=2
> ppid=9991 pid=10497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="date"
> exe="/bin/busybox.nosuid" key=(null)  

> type=EXECVE msg=audit(1554390377.124:5): argc=2 a0="date" a1="+%m%d%y-%H:%M:%S:%N"

> type=CWD msg=audit(1554390377.124:5): cwd="/" type=PATH
> msg=audit(1554390377.124:5): item=0 name="/bin/date" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> 
> type=PATH msg=audit(1554390377.124:5): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL

> type=SYSCALL msg=audit(1554390389.524:36): arch=40000003 syscall=11
> success=yes exit=0 a0=80f68a8 a1=80f6ae8 a2=80f3008 a3=80f6ae8 items=2
> ppid=9906 pid=10592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="cat"
> exe="/bin/busybox.nosuid" key=(null) 
> type=EXECVE
> msg=audit(1554390389.524:36): argc=2 a0="cat" a1="/tmp/cpuinfo"
> type=CWD msg=audit(1554390389.524:36): cwd="/"
> type=PATH
> msg=audit(1554390389.524:36): item=0 name="/bin/cat" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=PATH msg=audit(1554390389.524:36): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL

In the above log, I want only records where tty=pts*, I have tried egrep but I am not getting the output as expected.

egrep "tty=pts*|type=EXECVE" audit.log

Expected output:

type=EXECVE msg=audit(1554390389.524:36): argc=2 a0="cat" a1="/tmp/cpuinfo"

I want only the records with tty=pts[0-6] (excluding tty=none).

  • are you sure you're not interested in including the cwd from the type=CWD stanza, in case the command has any relative elements? – Jeff Schaller Apr 10 at 1:53
  • I do not want type=cwd,I need only type=EXECVE as it records the shell commands but the problem is it also records tty=(none) {background process}. I need to exclude that in either way adding rule to audit.rules. – fox18 Apr 10 at 5:32
0

Edited the code as per comment Kindly check

command

awk '/type=EXECVE/||/tty=pts*/{print $0}' filename
  • I need the type=EXECVE line,because it only stores the commands with arguments. – fox18 Apr 9 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.