Questions tagged [audit]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
20 views

auditd logs- /lib/ld-linux-x86-64.so.2 flooding logs

I am running auditd on a Debian 11 server with a very generic set of audit rules. The audit log is filled with entries like below. I'm not sure what they are - can anyone help identify these? I'm ...
user1309220's user avatar
1 vote
1 answer
53 views

Enabling command hashing in tcsh

It seems command hashing is disabled by default in our tcsh environment, and I'm not permitted to get it enabled across the board. Instead I'm looking to enable command hashing within individual ...
Maikol's user avatar
  • 155
1 vote
1 answer
57 views

Force tcsh to check whether command exist in the path before attempting to execute it

I've noticed that tcsh, regardless of whether "-f" flag is passed on the shebang line, will iterate through $PATH, and try to execute the command from that path until the command is found. ...
Maikol's user avatar
  • 155
1 vote
1 answer
144 views

How do I configure auditd to print the ppid name, not just the ppid?

OS is Debian. I have set up auditd to try and determine what is rebooting a system. I have the following rule: -a exit,always -F arch=b64 -S execve -F path=/bin/systemctl -k debug_test Creating a ...
cat pants's user avatar
  • 475
0 votes
1 answer
330 views

audit rule doesn't load via systemctl restart auditd

I was trying to see what was enabling ipv4 forwarding in file /proc/sys/net/ipv4/ip_forward (I've discovered that this was docker, but I'd still like to understand my auditd issue) So I decided to ...
wabbajack001's user avatar
0 votes
0 answers
39 views

Find most common offender in audit.log

I have a situation where a clean install of RHEL 8.8 and having auditd running with a given /etc/audit/rules.d/audit.rules file produces a /var/log/audit/audit.log that is greater than 4GB. This is ...
ron's user avatar
  • 6,617
0 votes
1 answer
38 views

Users setup with misspelled name - CentOS 8

I have a user with a misspelled username on my CentOS 8 system which I thought I had corrected but I have noticed the username is showing up in the audit log incorrectly. The correct username is: ...
Ewan's user avatar
  • 1
-1 votes
1 answer
94 views

I would like to audit an Ubuntu server to get a list of all files executed and all files read by the kernel

I want to be able to instrument and analyze at a prebuilt server and get a list of every file read. I would also like to determine which of those files were read by the kernel to execute a program, ...
kkron's user avatar
  • 109
0 votes
2 answers
405 views

Linux How to find the id of a user who ran some particular command using sudo [duplicate]

In shared environment where multiple users have sudo account, I want to find out underlying user id (not a sudo account) details who has invoked particular script. Thanks. I tried below but it does ...
AshwinD's user avatar
0 votes
3 answers
250 views

In Linux how to find if a file was read and at what time

Is there a tool or command where we can see if a file was read and at what time? I would only find for last modified.
kumar's user avatar
  • 201
0 votes
0 answers
333 views

Audit Logging Discrepancy: Journald vs Rsyslog

After installing Debian 12 and rsyslog 8.2302 (for TLS remote syslog), I noticed that apparmor logs (or any audit logs) were not being sent remotely. After reviewing the local system, journald DOES ...
user avatar
1 vote
0 answers
32 views

Linux audit logs coming in with capitalized field names (SYSCALL, AUID) Rhel 7

I've never encountered this before so not even sure where to start. I'm installing a log parser on a system but for some reason all audit logs are coming in with the field names capitalized. So ...
ccwildcard's user avatar
0 votes
0 answers
56 views

How to lookup the device id in audit log?

I want to find out who write the rootfs device with audit auditctl -w /var/lib -p w I got a log type=SYSCALL msg=audit(1687705400.741:250): arch=c000003e syscall=257 success=yes exit=4 a0=ffffff9c a1=...
wener's user avatar
  • 466
1 vote
1 answer
272 views

audit does not record file events (but works for network events) in fedora

I want to monitor access to a file using audit, and hence added the following rule -w /home/test.txt -k monitoring-test I reloaded the rules (sudo service auditd restart) and modified the file /home/...
black's user avatar
  • 113
0 votes
1 answer
107 views

Auditd stops monitoring USB mount point when USB is removed then reinserted

I'm working on scripted monitoring of USB activity: file reads, writes, folder creations, etc. Our codebase automatically sets up a mount point in: /media/usb/mounted_usb_name, when a USB device is ...
southlakesvibes's user avatar
2 votes
0 answers
27 views

Unixware: how to enable auditing for specific user?

On Unixware I have enable auditing auditon create the map auditmap The log report is working auditrpt -b But only for root! auditrpt -u root|wc -l 647 I try to set a mask for auditing for another ...
elbarna's user avatar
  • 12.7k
1 vote
1 answer
980 views

What is writing to my /dev/dm-2 Volume?

I'm running a STIG version of RHEL, and I’m having trouble figuring out how all of my logical volumes map. /dev/mapper/vg1_audit seems to point to /dev/dm-2 /dev/vg1/lv_audit also seems to map to /dev/...
dberm22's user avatar
  • 113
0 votes
1 answer
85 views

Configuring AIX auditing for rmdir and syslog collection

How can the auditing feature in an AIX Unix system be configured to collect information about the removal of a directory (though rmdir) and send it to syslog?
Tekkkee's user avatar
0 votes
1 answer
2k views

Arch Linux stuck at boot after a restart

I was just having fun with installing Wayland and customizing it to my liking and when I finally restarted it before I go to bed, it was stuck on the logo. So, I enabled logging for grubs and it's ...
Zettomon's user avatar
1 vote
1 answer
239 views

Setting up auditd on FreeBSD 13 to log user commands

I modified /etc/security/audit_control by adding the ex ("exec") and ad ("administrative") audit classes to the flags: flags:lo,aa,ex,ad I enabled and started the service service ...
user548242's user avatar
0 votes
1 answer
191 views

Is it possible to filter or format the audit dmesg reports?

I like having a terminal open with dmesg so I can see the logs in real-time. However, the audit logs are quite long, and I was wondering if there was a way to filter messages (maybe with sed/awk?) ...
ZackT's user avatar
  • 13
-1 votes
1 answer
90 views

How to make Linux installation verifiable/auditable?

A major goal of open source is being able to audit/verify the software you run. But the moment we use that software hosted by a third-party we need to trust them.. If I ran an OSS service on a Linux ...
ln3xp's user avatar
  • 1
1 vote
0 answers
174 views

convention of group id for audit

in /etc/audit/auditd.conf there is log_group = root. I have been asks to change that to log_group = audit to facilitate logging. In RHEL 7.9 there is no audit group defined in /etc/group; someone ...
ron's user avatar
  • 6,617
0 votes
1 answer
43 views

Change audit directory permission to another user beside root

I want to grant permision to another user for audit directory. [user_audit@crox log]$ cd audit bash: cd: audit: Permission denied [user_audit@crox log]$ ls -lrt | grep audit drwx------. 2 root ...
sticletele's user avatar
0 votes
0 answers
97 views

Linux utility to log user commands and screenshots for auditing

I am looking for a utility that I can implement in linux systems to "audit" user commands in the terminals and take intermittent screenshots for auditing in my systems. Is there a solution ...
tom's user avatar
  • 1
0 votes
0 answers
2k views

Send audit log to syslog server as independent stream

I have a system which is currently set up via rsyslogd to send /var/log/messages to a syslog server. I also want to send the logs contained in /var/log/audit/audit.log to the same server. One of the ...
dcom-launch's user avatar
3 votes
0 answers
2k views

set sshd SELinux security context

I'm working on my custom board and on my custom UNIX-like O.S. . When I connect using ssh and no root users a receve this SELinux error: A valid context for could not be obtained. where user is not ...
init's user avatar
  • 31
0 votes
2 answers
331 views

How to log flag changes to files on ext4 and xfs filesystems?

I was wondering how to log flag changes in a file, e.g. chattr +a somefile. I realized that timestamps shown by stat somefile are not useful to audit flag changes: when the file is appended, it ...
monovox's user avatar
-3 votes
2 answers
104 views

Is there any way to prevent someone from running a shell as root?

This is a question I've pondered for a long time and thought was impossible. Is it possible to prevent administrators of a machine from bypassing the audit capabilities of sudo or doas? For instance, ...
Brian's user avatar
  • 1
0 votes
1 answer
543 views

Parse audit log commands as a complete command with arguments

I have audit logs that looks as follows: type=CWD msg=audit(1613110144.560:260397): cwd="/" type=PATH msg=audit(1613110144.560:260397): item=0 name="/usr/bin/sed" inode=393388 dev=...
Anthony Bell's user avatar
0 votes
0 answers
14 views

certificate authority "like" or similar service that provides open source audit and certificate proving project does not contain malicious code

Compliance is not my area, so I apologize for the naive language, as I am having trouble explicitly articulating my want, beyond the following anecdote: If one were to build a solution for an audience ...
christian elsee's user avatar
0 votes
0 answers
528 views

What caused traffic on port 631?

After I turn on my computer, something triggers tcp packets from localhost with source port 631. I replicated the packets using the command ipptools. Assuming I got it right, is there a way for me to ...
u20200411's user avatar
0 votes
1 answer
1k views

accessing /var/log/audit/audit.log without root password

under RHEL 7.8 drwxr-xr-x. 20 root root 4096 May 1 11:13 var drwxr-xr-x. 24 root root 4096 Sep 27 03:22 log drwx------. 2 root root 4096 Sep 2 03:34 audit -rw-------...
ron's user avatar
  • 6,617
0 votes
1 answer
53 views

SUSE LINUX 11 - Being Able To Collect User Information (Audit)

I added the following lines to the /etc/audit/audit.rules file and restarted the machine: -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/...
Help's user avatar
  • 97
-2 votes
1 answer
63 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
Jason's user avatar
  • 1,734
1 vote
1 answer
2k views

auditd not compressing logs during rotation

Audit is not compressing any logs. Perhaps this is a config issue. Could you perhaps tell me what's causing this in the below config? local_events = yes write_logs = yes log_file = /var/log/audit/...
aardbol's user avatar
  • 663
0 votes
1 answer
960 views

Can not log permission denied errors using auditctl [closed]

I try to create an auditctl rule for the following situation: There is a file created by root, owned by root, and with chmod 700. So no other user except root can read or write to it. When I then try ...
Arpton's user avatar
  • 33
2 votes
2 answers
139 views

Kill OS if process is killed

I have a bespoke monitoring application I'm deploying on a linux cluster I wish to secure. I would like the process not to be possible to kill. That said, senior users need root. I read that I can ...
Woodstock's user avatar
  • 408
3 votes
1 answer
3k views

How to log connect/disconnects of outgoing ssh sessions?

I'm looking to log connections/disconnections from outgoing ssh sessions. Is this something auditd can do? I am able to get logs via auditbeat of the connections going outbound but the tricky part is ...
emvee's user avatar
  • 151
0 votes
2 answers
299 views

Questions about audit

After executing the following instruction auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change it returned the following error -F ...
zebrakky's user avatar
6 votes
1 answer
474 views

How to detect which process has used a file now or in the past

This is a hypothetical question, not a problem I currently have. How do you detect which process has used a file now or in the past? To find out which process is accessing filename right now, lsof ...
dr_'s user avatar
  • 29.7k
6 votes
1 answer
6k views

Why do I get a warning for the sudoers.d when doing an audit with Lynis?

I stumbled upon Lynis - a security auditing tool for linux - and ran it on my Raspberry Pi to see if I could harden it a bit more. I got one warning in the Authentication group that confuses me. - ...
Philipp A.'s user avatar
2 votes
1 answer
74 views

Can substantial data theft (file access) be detected after the fact?

Suppose an employee came in to the office for a whole day over the weekend and shortly thereafter handed in their notice. Is there a way on Linux (in our case Centos 7) to eliminate the possibility ...
it's a hire car baby's user avatar
2 votes
1 answer
790 views

ausearch: NOT operator in string match

When examining network activity logs from audit, I want to exclude a few programs I know, e.g. firefox. ausearch -x firefox -i brings up all firefox-related connections. But common NOT-operators ...
FelixJN's user avatar
  • 13.6k
1 vote
1 answer
407 views

Perform special action on bash timeout

This question is related only to bash, no ssh or any other tool. I would like to detect a bash timeout, and only a timeout: I am NOT interested in any other exit conditions (exit, EOF, ^D, or ...
volingas's user avatar
  • 193
0 votes
1 answer
98 views

How to interpret /var/log output

I have trouble interpreting the following output from /var/log. Both lines show the same result but of different date? What does this mean? Currently doing an audit to ensure that the directories are ...
teo93's user avatar
  • 7
1 vote
0 answers
940 views

Continuously monitoring network connections

I am looking for a network monitoring tool that can monitor all opened network connections in real-time and its output is easy to parse. What I want to achieve is auditing all in/out network ...
Jacfal's user avatar
  • 21
3 votes
1 answer
477 views

How to disable sudo in containers from audit logging to host

How do I disable sudo inside of LXC containers from writing to the audit log on the host? Both the host and containers are Fedora 29. We run many containers running automated tests. Some of those ...
penguin359's user avatar
  • 12.1k
4 votes
1 answer
4k views

Auditd, Syslog and Journald

I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me. According to the things I read, auditd audits events in the ...
Eran Nahshon's user avatar
0 votes
1 answer
120 views

How to inventory apps on Linux Desktop?

[N.B. My first post - guidance welcomed] We have a small local network of users (5) on deb-based systems and would like to maintain an index of apps installed. How can we, programmatically, ...
Ned Burgher's user avatar