0

Is there any way to exclude the event records having tty=(none)

I have tried many ways of adding rule but nothing worked out. This is my current log file:

 > > type=SYSCALL msg=audit(1554390377.124:5): arch=40000003 syscall=11
    > > success=yes exit=0 a0=810cf88 a1=810bd88 a2=80f5008 a3=810bd88 items=2
    > > ppid=9991 pid=10497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
    > > egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="date"
    > > exe="/bin/busybox.nosuid" key=(null)  
    > 
    > > type=EXECVE msg=audit(1554390377.124:5): argc=2 a0="date" a1="+%m%d%y-%H:%M:%S:%N"
    > 
    > > type=CWD msg=audit(1554390377.124:5): cwd="/" type=PATH
    > > msg=audit(1554390377.124:5): item=0 name="/bin/date" inode=1538
    > > dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
    > > 
    > > type=PATH msg=audit(1554390377.124:5): item=1 name=(null) inode=969
    > > dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
    > 
    > > type=SYSCALL msg=audit(1554390389.524:36): arch=40000003 syscall=11
    > > success=yes exit=0 a0=80f68a8 a1=80f6ae8 a2=80f3008 a3=80f6ae8 items=2
    > > ppid=9906 pid=10592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
    > > egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="cat"
    > > exe="/bin/busybox.nosuid" key=(null) 
    > > type=EXECVE
    > > msg=audit(1554390389.524:36): argc=2 a0="cat" a1="/tmp/cpuinfo"
    > > type=CWD msg=audit(1554390389.524:36): cwd="/"

I need only the following lines in log file where tty=pts0/pts[any number]:

> type=SYSCALL msg=audit(1554390389.524:36): arch=40000003 syscall=11
> success=yes exit=0 a0=80f68a8 a1=80f6ae8 a2=80f3008 a3=80f6ae8 items=2
> ppid=9906 pid=10592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="cat"
> exe="/bin/busybox.nosuid" key=(null) 
> type=EXECVE
> msg=audit(1554390389.524:36): argc=2 a0="cat" a1="/tmp/cpuinfo"
> type=CWD msg=audit(1554390389.524:36): cwd="/"
> type=PATH
> msg=audit(1554390389.524:36): item=0 name="/bin/cat" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=PATH msg=audit(1554390389.524:36): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
1
  • Since you mentioned that you "... have tried many ways of adding rule but nothing worked out." can you share your rules which are working and which not? As also a list of the non working rules?
    – U880D
    Commented Sep 22, 2019 at 13:13

1 Answer 1

0

As far as I understand How to exclude specific users or groups when using auditd to watch files and How to exclude specific users, groups, or services when using auditd to audit syscalls, you could exclude specific services and keys by using filters _F with not (!), i.e.

-F subj_type!=SYSCALL

and/or

-F tty=(none)

Maybe you need to add some more specifications.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .