Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [audit]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

auditd + auditsp doesn't write log to remote server

I set up auditd + audisp on Ubuntu for centralized collection of logs on the server Config files on the client host: auditd.conf: #This file controls the configuration of the audit daemon # #...
user avatar
0 votes
0 answers
65 views

Send audit log to syslog server as independent stream

I have a system which is currently set up via rsyslogd to send /var/log/messages to a syslog server. I also want to send the logs contained in /var/log/audit/audit.log to the same server. One of the ...
user avatar
3 votes
0 answers
156 views

set sshd SELinux security context

I'm working on my custom board and on my custom UNIX-like O.S. . When I connect using ssh and no root users a receve this SELinux error: A valid context for could not be obtained. where user is not ...
user avatar
  • 31
0 votes
0 answers
123 views

audit log format ( ENRICHED ) in centos 7

We are trying to use Wazuh with audit logs in centos and facing issues while determining the key when enriched log format is being used. Example below key="XXXX"ARCH=x86_64 They key is ...
user avatar
  • 1,681
0 votes
2 answers
61 views

How to log flag changes to files on ext4 and xfs filesystems?

I was wondering how to log flag changes in a file, e.g. chattr +a somefile. I realized that timestamps shown by stat somefile are not useful to audit flag changes: when the file is appended, it ...
user avatar
-3 votes
2 answers
69 views

Is there any way to prevent someone from running a shell as root?

This is a question I've pondered for a long time and thought was impossible. Is it possible to prevent administrators of a machine from bypassing the audit capabilities of sudo or doas? For instance, ...
user avatar
  • 1
0 votes
1 answer
107 views

Parse audit log commands as a complete command with arguments

I have audit logs that looks as follows: type=CWD msg=audit(1613110144.560:260397): cwd="/" type=PATH msg=audit(1613110144.560:260397): item=0 name="/usr/bin/sed" inode=393388 dev=...
user avatar
0 votes
0 answers
13 views

certificate authority "like" or similar service that provides open source audit and certificate proving project does not contain malicious code

Compliance is not my area, so I apologize for the naive language, as I am having trouble explicitly articulating my want, beyond the following anecdote: If one were to build a solution for an audience ...
user avatar
0 votes
0 answers
118 views

What caused traffic on port 631?

After I turn on my computer, something triggers tcp packets from localhost with source port 631. I replicated the packets using the command ipptools. Assuming I got it right, is there a way for me to ...
user avatar
0 votes
1 answer
380 views

accessing /var/log/audit/audit.log without root password

under RHEL 7.8 drwxr-xr-x. 20 root root 4096 May 1 11:13 var drwxr-xr-x. 24 root root 4096 Sep 27 03:22 log drwx------. 2 root root 4096 Sep 2 03:34 audit -rw-------...
user avatar
  • 4,131
0 votes
1 answer
43 views

SUSE LINUX 11 - Being Able To Collect User Information (Audit)

I added the following lines to the /etc/audit/audit.rules file and restarted the machine: -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/...
user avatar
  • 77
-2 votes
1 answer
53 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
user avatar
  • 1,672
1 vote
1 answer
770 views

auditd not compressing logs during rotation

Audit is not compressing any logs. Perhaps this is a config issue. Could you perhaps tell me what's causing this in the below config? local_events = yes write_logs = yes log_file = /var/log/audit/...
user avatar
  • 553
0 votes
1 answer
618 views

Can not log permission denied errors using auditctl [closed]

I try to create an auditctl rule for the following situation: There is a file created by root, owned by root, and with chmod 700. So no other user except root can read or write to it. When I then try ...
user avatar
  • 33
2 votes
2 answers
99 views

Kill OS if process is killed

I have a bespoke monitoring application I'm deploying on a linux cluster I wish to secure. I would like the process not to be possible to kill. That said, senior users need root. I read that I can ...
user avatar
  • 336
2 votes
1 answer
1k views

How to log connect/disconnects of outgoing ssh sessions?

I'm looking to log connections/disconnections from outgoing ssh sessions. Is this something auditd can do? I am able to get logs via auditbeat of the connections going outbound but the tricky part is ...
user avatar
  • 31
0 votes
2 answers
245 views

Questions about audit

After executing the following instruction auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change it returned the following error -F ...
user avatar
6 votes
1 answer
154 views

How to detect which process has used a file now or in the past

This is a hypothetical question, not a problem I currently have. How do you detect which process has used a file now or in the past? To find out which process is accessing filename right now, lsof ...
user avatar
  • 25.4k
5 votes
1 answer
3k views

Why do I get a warning for the sudoers.d when doing an audit with Lynis?

I stumbled upon Lynis - a security auditing tool for linux - and ran it on my Raspberry Pi to see if I could harden it a bit more. I got one warning in the Authentication group that confuses me. - ...
user avatar
  • 107
2 votes
1 answer
67 views

Can substantial data theft (file access) be detected after the fact?

Suppose an employee came in to the office for a whole day over the weekend and shortly thereafter handed in their notice. Is there a way on Linux (in our case Centos 7) to eliminate the possibility ...
user avatar
2 votes
1 answer
368 views

ausearch: NOT operator in string match

When examining network activity logs from audit, I want to exclude a few programs I know, e.g. firefox. ausearch -x firefox -i brings up all firefox-related connections. But common NOT-operators ...
user avatar
  • 10.6k
1 vote
1 answer
277 views

Perform special action on bash timeout

This question is related only to bash, no ssh or any other tool. I would like to detect a bash timeout, and only a timeout: I am NOT interested in any other exit conditions (exit, EOF, ^D, or ...
user avatar
  • 163
0 votes
1 answer
48 views

How to interpret /var/log output

I have trouble interpreting the following output from /var/log. Both lines show the same result but of different date? What does this mean? Currently doing an audit to ensure that the directories are ...
user avatar
  • 7
1 vote
0 answers
291 views

Continuously monitoring network connections

I am looking for a network monitoring tool that can monitor all opened network connections in real-time and its output is easy to parse. What I want to achieve is auditing all in/out network ...
user avatar
  • 21
3 votes
1 answer
285 views

How to disable sudo in containers from audit logging to host

How do I disable sudo inside of LXC containers from writing to the audit log on the host? Both the host and containers are Fedora 29. We run many containers running automated tests. Some of those ...
user avatar
  • 11.4k
3 votes
1 answer
2k views

Auditd, Syslog and Journald

I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me. According to the things I read, auditd audits events in the ...
user avatar
0 votes
1 answer
80 views

How to inventory apps on Linux Desktop?

[N.B. My first post - guidance welcomed] We have a small local network of users (5) on deb-based systems and would like to maintain an index of apps installed. How can we, programmatically, ...
user avatar
0 votes
1 answer
987 views

why would ldconfig create a symlink to libselinux.so.1 from libext2fs.so.2?

using strace I have found a behaviour of ldconfig (glibc), I can make no sense of lstat("/usr/lib/libext2fs.so.2", {st_mode=S_IFLNK|0777, st_size=16, ...}) = 0 unlink("/usr/lib/libext2fs.so.2") ...
user avatar
1 vote
0 answers
169 views

How do you configure auditd logs to show up in journalctl?

I cannot find the usual auditd logs when doing "journalctl | grep msg=audit". However, I do see the auditd logs in /var/log/audit/audit.log and when doing ausearch. Is there a way to configure it so ...
user avatar
  • 205
0 votes
1 answer
236 views

how to extracting only few records from audit.log

How to Extract audit.log While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
user avatar
  • 5
1 vote
2 answers
2k views

Understanding the audit log - file permissions and file content changed

I need to understand the log below, my index.php got obfuscated code, and file permissions changed from 644 to 755 as well. I've got something in my audit but can't really tell what and how it ...
user avatar
  • 13
3 votes
1 answer
3k views

Tracking all file changes in a unix host

I'm evaluating a tool and I need to identify all files (including system config files) added, changed or removed by this application (it is installed using pip). After installing on a external host, ...
user avatar
3 votes
1 answer
3k views

How to log failure to start/stop a service?

I want to track whether a normal user attempted to run a service. The command for starting/stopping service is given as below: service filebeat start I wrote an auditd rule like below: -w /usr/sbin/...
user avatar
1 vote
0 answers
53 views

Freeze Linux when log is full

Is it possible to configure a Linux server to stop all operations when it cannot create logs, similar to the security policy in Windows called "Audit: Shut down system immediately if unable to log ...
user avatar
0 votes
1 answer
2k views

check auditd version

Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name? For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
user avatar
2 votes
1 answer
547 views

What is the purpose of auditctl -a never,task?

I see that whenever I start a new ec2 server the default rule for auditctl is auditctl -a never,task What is the purpose of having this rule?
user avatar
  • 21
0 votes
2 answers
3k views

Getting error when stopping auditd

I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
user avatar
  • 868
2 votes
1 answer
239 views

Audit file modifications over ssh in Linux

I wanted to monitor all the modifications made to file in Linux server On some research I found audit tool which I have installed and configured using following commands yum install audit # ...
user avatar
1 vote
1 answer
905 views

Encryption of syslog & auditd in local disk? [closed]

We need to use encrypted syslog and auditd in local disk. Is it possible to save syslog and auditd message encrypted in disk ?
user avatar
  • 1,317
1 vote
2 answers
39 views

servresolv.conf become blank when system is running

I use dhcpcd to manage this file. First, start dhcpcd service, and the file has something with namesever. All things can be done correctly. But this file will become blank after a while. I try ...
user avatar
  • 248
1 vote
1 answer
56 views

How is source code reviewed/audited, prior to inclusion in linux mainline?

An answer to this question would provide insight and references about how the linux kernel source code is reviewed prior to be released? Particular interesting aspect of this question to me are: Who ...
user avatar
1 vote
0 answers
141 views

AIX auditpr timestamp format

Is there a way to customize the timestamp format that the auditpr command on AIX generates? I am logging to binary, and when I use auditpr to read the binary audit logs, I get something similar to : ...
user avatar
1 vote
0 answers
383 views

Why ausearch does not find matches for SYSTEM_BOOT and SYSTEM_SHUTDOWN?

I ask myself why I get no matches when I search for SYSTEM_BOOT or SYSTEM_SHUTDOWN. ausearch -m SYSTEM_BOOT ausearch -m SYSTEM_SHUTDOWN To be sure that events are not getting lost during booting I ...
user avatar
  • 11
1 vote
1 answer
964 views

What is the Windows equivalent of 'Audit log cleared' event in Unix/Linux?

Windows has EventID 1102 "The audit log was cleared". What is the equivalent audit event in Unix/Linux? If someone has a sample event, and know what audit policy needs to be configured to get this ...
user avatar
  • 113
3 votes
1 answer
1k views

How to decode audit logs

I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this: time->Tue Jun 12 16:23:34 2018 type=...
user avatar
  • 141
1 vote
1 answer
2k views

Difference between Failed Authentications and Failed Logins in aureport [closed]

Lately I've been exploring the aureport tool, but I've noticed the following in the outputs and behavior of it. For example, running the following command: # aureport --failed Displays the ...
user avatar
1 vote
1 answer
164 views

aureport -l doesnt show the sucessful count of the user who used "su" command

why the command aureport -l --success --summary -i does show the successful login count of the user who used su command. The output the above said command only calculates sshd, gdm sessions but not ...
user avatar
  • 41
0 votes
1 answer
345 views

How to install audit2allow on Alpine Linux 3.5?

I am coming from an apt-get background and am now trying (and failing) to use Alpine Linux's apk utility for package management. I try running apk install audit2allow and end up with a help message ...
user avatar
1 vote
1 answer
157 views

Fastest way to locate any files/dirs with different ACLs than parent? (FreeBSD)

As the question says. I have a data pool with ~ 10M files with access controlled by NFSv4 ACLs. It's usable from CLI, Samba, sometimes by daemon processes or rsync, and for some dirs by ftp/sftp, so ...
user avatar
  • 1,111
0 votes
1 answer
191 views

Logger -f command killed opening /var/log/messages in tail

I'm trying to run this command on CentOS. logger -t AUDIT_LOG -f <MY_AUDIT_LOG_FILE> & It works correctly for 10/20 seconds. Opening /var/log/messages in tail I can correctly see messages ...
user avatar