I'm running auditd with a bunch of rules for PCI-DSS, but i have some anomalies.

cat audit.log | grep type | grep AVC

returns a bunch of entries like

type=AVC msg=audit(1567154215.586:353): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.core" pid=22810 comm="apparmor_parser"

but when running ausearch -m AVC -if audit.log it doesn't return any entries. Is there something i'm missing ( or has been replaced )?

Also there's a rule for sudo -w /usr/bin/sudo -p x -k priv_esc but whenever i sudo to root, there isn't a corresponding entry in the audit logs.

Is there something wrong with my setup?

  • 1
    Ok, so the message type for sudo is CRED_REFR or USER_START. or an ausearch -c sudo. And the logs are populated with entries for sudo. However, when i was tailing the logs to see the logged events the other day, the sudo entries didn't appear. Does auditd buffer or immediately write to disk? The other thing that i did during that time was to download kernel headers. Could this have affected auditd's capabilities? – placid chat Sep 13 at 6:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.