0

I have recently install auditd and play around with it. And i found on ubuntu 18 the auditd log will show record entry like this

audit[23183]: USER_CMD pid=23183 uid=1000 auid=1000 ses=517 msg='cwd="/home/vmtest1" cmd="pwd" terminal=pts/0 res=success Note that it shows USER_CMD type record (References = https://access.redhat.com/articles/4409591#audit-record-types-2) BUT - when i preform the same on ubuntu 20 or above, it does not show that event type record. I was wondering why. I have try to do some research on this and can not find a answer on how to configure this in auditd or why is it acting this way. That USER_CMD record type should be on all auditd pacakge regardless which Os as a default setting ... Would like some input on this. thanks

PS .. type=syscall also not appearing on ubuntu 18 but does on newer os.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.