Questions tagged [audit]
The audit tag has no usage guidance.
0
votes
0answers
22 views
Tracing writes to files and devices
I would like to audit writes to a specific file (like /home/john/file.txt) and/or a specific device (like /dev/tty/1). How to do it? By audit I mean:
What was written by process?
Solution based on ...
1
vote
0answers
21 views
Freeze Linux when log is full
Is it possible to configure a Linux server to stop all operations when it cannot create logs, similar to the security policy in Windows called "Audit: Shut down system immediately if unable to log ...
0
votes
1answer
42 views
check auditd version
Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name?
For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
0
votes
0answers
37 views
'auditctl -l' output is different between different auditd version
I need to match a regex against the output of 'auditctl -l' command.
From the several checks I conducted I saw a difference in output convention writing in different audit versions (for the same audit ...
1
vote
1answer
26 views
What is the purpose of auditctl -a never,task?
I see that whenever I start a new ec2 server the default rule for auditctl
is
auditctl -a never,task
What is the purpose of having this rule?
0
votes
1answer
72 views
Getting error when stopping auditd
I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
2
votes
1answer
66 views
Audit file modifications over ssh in Linux
I wanted to monitor all the modifications made to file in Linux server
On some research I found audit tool which I have installed and configured using following commands
yum install audit # ...
1
vote
1answer
88 views
Encryption of syslog & auditd in local disk? [closed]
We need to use encrypted syslog and auditd in local disk.
Is it possible to save syslog and auditd message encrypted in disk ?
1
vote
2answers
26 views
servresolv.conf become blank when system is running
I use dhcpcd to manage this file.
First, start dhcpcd service, and the file has something with namesever.
All things can be done correctly.
But this file will become blank after a while.
I try ...
0
votes
1answer
40 views
How is source code reviewed/audited, prior to inclusion in linux mainline?
An answer to this question would provide insight and references about how the linux kernel source code is reviewed prior to be released?
Particular interesting aspect of this question to me are:
Who ...
1
vote
0answers
36 views
AIX auditpr timestamp format
Is there a way to customize the timestamp format that the auditpr command on AIX generates?
I am logging to binary, and when I use auditpr to read the binary audit logs, I get something similar to :
...
1
vote
0answers
47 views
Why ausearch does not find matches for SYSTEM_BOOT and SYSTEM_SHUTDOWN?
I ask myself why I get no matches when I search for SYSTEM_BOOT or SYSTEM_SHUTDOWN.
ausearch -m SYSTEM_BOOT
ausearch -m SYSTEM_SHUTDOWN
To be sure that events are not getting lost during booting I ...
1
vote
1answer
148 views
What is the Windows equivalent of 'Audit log cleared' event in Unix/Linux?
Windows has EventID 1102 "The audit log was cleared". What is the equivalent audit event in Unix/Linux?
If someone has a sample event, and know what audit policy needs to be configured to get this ...
0
votes
0answers
94 views
Hostname in the audit reports not shown
I'm creating a nfs share. Also i configured auditd to combine the logs to a centralized server.
I configured audisp-remote as per the instructions in the link:
https://luppeng.wordpress.com/2016/08/...
3
votes
1answer
247 views
How to decode audit logs
I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this:
time->Tue Jun 12 16:23:34 2018
type=...
0
votes
1answer
187 views
Difference between Failed Authentications and Failed Logins in aureport [closed]
Lately I've been exploring the aureport tool, but I've noticed the following in the outputs and behavior of it.
For example, running the following command:
# aureport --failed
Displays the ...
0
votes
1answer
43 views
aureport -l doesnt show the sucessful count of the user who used “su” command
why the command aureport -l --success --summary -i does show the successful login count of the user who used su command.
The output the above said command only calculates sshd, gdm sessions but not ...
0
votes
0answers
32 views
AIX Logging Configurations
I would like monitor specific/target files and directories on AIX server by enabling audit on only those files and directories without enabling global file and directory auditing.
The specific files ...
0
votes
0answers
67 views
How to install audit2allow on Alpine Linux 3.5?
I am coming from an apt-get background and am now trying (and failing) to use Alpine Linux's apk utility for package management.
I try running apk install audit2allow and end up with a help message ...
1
vote
1answer
38 views
Fastest way to locate any files/dirs with different ACLs than parent? (FreeBSD)
As the question says.
I have a data pool with ~ 10M files with access controlled by NFSv4 ACLs. It's usable from CLI, Samba, sometimes by daemon processes or rsync, and for some dirs by ftp/sftp, so ...
0
votes
1answer
117 views
Logger -f command killed opening /var/log/messages in tail
I'm trying to run this command on CentOS.
logger -t AUDIT_LOG -f <MY_AUDIT_LOG_FILE> &
It works correctly for 10/20 seconds. Opening /var/log/messages in tail I can correctly see messages ...
1
vote
0answers
58 views
Shell command audit for a single user
What is the easiest way to log all the commands ran in the all different shells (bash, zsh...) by a certain user to a file, syslog or somewhere else?
0
votes
0answers
30 views
Is there a way to log attempts to change a file in RHEL6?
We have a RHEL6 server that was built using an old homegrown build platform. The team that built the platform was disbanded, and all members have moved on. So, we are trying to figure out everything ...
3
votes
0answers
144 views
Can aureport show the full path to files?
I'm tailing auditd.log and piping it into ausearch and then aureport, with the aim of getting a simple stream of modified files:
tail -f /var/log/audit/audit.log | ausearch -k my_key | aureport -f --...
4
votes
1answer
103 views
Changes made with chattr are not detected by auditd
I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using:
auditctl -w /etc/my_path_to_monitor -p wa -k my_rule
This works great for everything ...
7
votes
2answers
1k views
List all programs used by a shell script
I'm trying to figure out a method to list all the programs that a script will use when it will be run, without actually running it.
I've written these quick and dirty oneliners:
# fill an array with ...
0
votes
1answer
86 views
How to enable audit on access to files (rwx) in SLES9
How can I enable audit on access to specific files in Suse Linux Enterprise 9?
1
vote
1answer
266 views
How do I interpret audit message logged during shutdown? [closed]
My machine (RHEL 7.4) is hanging during shutdown and displaying the following audit message:
type=1300 audit(1503569606.186:27573): arch=c000003e syscall=2 sucess=no exit=-13 a0=7ffee8a3db90 a1=2 a2=...
0
votes
2answers
892 views
Configuring Solaris 11 Audit
Recently I was working trying to activate the solaris audit service to record logs and write them in a single file in /var/adm/auditlog.
The thing is, I was trying to find some useful info about it ...
1
vote
0answers
121 views
autrace - Does it call auditctl or not?
The autrace man page summary is a little confusing:
This command deletes all audit rules prior to executing the target program and after executing it. As a safety precaution, it will not run ...
1
vote
0answers
256 views
Enabling custom auditd logging in RedHat
I enabled the auditd service using the following configuration to trace all user activities (belonging to group ID 555) on RedHat OS:
vim /etc/audit/audit.rules
-a always,exit -F gid=555 -F arch=b64 -...
3
votes
1answer
41 views
BSM and memory usage
Currently have BSM installed on my solaris 10 on my virtual machine. What I'm trying to do is that I want to measure the impact of enabling BSM (auditing) on Solaris on the CPU, memory.
So after ...
1
vote
0answers
62 views
Why does this `aureport` show a question mark in the 'exe' field?
I'm trying to debug why my docker socket changes ownership on a weekly basis.
I created an audit log rule on /var/run/docker.sock.
The audit report shows me many events happening to that socket, but ...
1
vote
0answers
53 views
Audit a command with a parameter under Linux
I want to use audit function of Linux to audit a Linux command date -s. If I write -w /bin/date -p x -k system-call in audit.rules, it will record when I use the command date. But I don't want it to ...
3
votes
1answer
321 views
Every AD SSH login starts with a failure in audit.log
Whenever I login to my Centos 7.x server I always get a transparent failure in the audit.log. This is making my attempts to have a daily script for failed logins very difficult as we can't be sure ...
4
votes
1answer
320 views
linux audit events not passed to go-audit
We're attempting to use slack's go-audit tool to capture/process linux audit events. More info: https://github.com/slackhq/go-audit
The issue is that the linux audit is correctly picking up events, ...
1
vote
2answers
125 views
Viewing relevant information about file accesses from the audit log
Assume, you have a Linux machine and there are three users -
user1, user2 and user3, who can log in to the machine.
You created a rule
$ auditctl -w /etc/file.txt -p rwxa
If you would like to see ...
5
votes
0answers
318 views
How to capture the xtrace output (only) in a file?
I know that I can redirect the xtrace output to some_file with something like this:
exec 2 >> some_file
set +x
...but this sends to some_file not only the xtrace output, but also any other ...
0
votes
1answer
518 views
HPUX 11i v3 Auditing to a syslog server - Configuration
I had trouble setting up auditing on our HPUX system and sending the same to a SIEM solution as a multiline log.
The issue was that audsys writes the log to binary files and I need it to be setup in ...
1
vote
2answers
79 views
Monitor accesses to directory on a Linux machine [duplicate]
How would you monitor a directory on a Linux machine to check if there was a user (or someone from the network) who attempted to access it?
1
vote
0answers
66 views
How do you block a specific process (such as vim) from accessing a mounted disk?
If I have a disk mounted on my hard-drive, I want to be able to block all but specific processes from having read/write access to that disk. Currently, I'm thinking the best way is to audit the disk ...
1
vote
0answers
31 views
Audit is not watching /mnt/foo on RHEL4
======New info =====
On my RHEL4 system, auditctl is failing to watch only when something is mounted via the mount command. The same directory works fine when it is unmounted. The version of audit is ...
2
votes
2answers
104 views
What does undocumented “proto” command line argument do in auditdistd on FreeBSD?
As you might know there is an auditdistd(8) daemon available on FreeBSD. It has some documented command line arguments like -c, -d, etc. (see more here (link)).
I was trying to learn how it works ...
1
vote
2answers
829 views
Monitor which application generate ICMP/ping traffic
I'm having problem with this,
Something in my system (Linux/Fedora 24/x64) keep sending ping's to several IP address,
and i like to know which process is responsible for this.
I found several ...
2
votes
1answer
254 views
How to monitor syscalls being called by a user on FreeBSD using auditing?
I would like to monitor every syscall being called on my FreeBSD using auditd. I know it is possible on Linux but I cannot
find any information on how I should configure FreeBSD.
Is it even possible ...
2
votes
1answer
202 views
Reporting Seccomp violations
When running seccomp-constrained processes, I would like to see any seccomp violations in some logs. Some googling online shows that these violations are reported to either syslog or audit.log. ...
2
votes
1answer
1k views
Run command on ssh login and logout when the command ends
We'd like to keep track of user activity on one of our Centos7 machine. To do
so, management decided to use script and scriptreplay to basically records user activity and replays it. I did some ...
0
votes
1answer
189 views
Is the regex defining the arguments to the execve syscall in the Linux Audit standard still used?
According to the field dictionary[1] there are fields which names are defined by the following regex:
a[[:digit:]+]\[.*\]
I was able to find examples of fields like a4 and a5 (see 2) but it doesn't ...
3
votes
2answers
68 views
Protect session log from being written again by anyone
We have implemented a workaround to save command history in a new file for each user session for audit purpose. So each session file is identified by the start time and the username.
The problem: The ...
1
vote
1answer
51 views
Where can I find the most recent dictionary of standard Linux Audit event fields?
I am writing a converter which takes Linux Audit logs as input. I tried to find the most recent dictionary file where all the valid names of the fields are defined.
I've found such a file[1] but the ...
