I have recently install auditd and play around with it. And i found on ubuntu 18 the auditd log will show record entry like this

audit[23183]: USER_CMD pid=23183 uid=1000 auid=1000 ses=517 msg='cwd="/home/vmtest1" cmd="pwd" terminal=pts/0 res=success Note that it shows USER_CMD type record (References = https://access.redhat.com/articles/4409591#audit-record-types-2) BUT - when i preform the same on ubuntu 20 or above, it does not show that event type record. I was wondering why. I have try to do some research on this and can not find a answer on how to configure this in auditd or why is it acting this way. That USER_CMD record type should be on all auditd pacakge regardless which Os as a default setting ... Would like some input on this. thanks

PS .. type=syscall also not appearing on ubuntu 18 but does on newer os.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.