Skip to main content

Questions tagged [linux-audit]

Content related to the Linux Audit standard which is the most popular auditing tool used in GNU/Linux distributions.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

Monitoring start and stop processes

Im trying to monitor the start and stop of processes on a server with auditd, using the following rule -w /usr/bin/ -p x -k T1569.002 however, when raising an event to generate the log and searching ...
David Pérez's user avatar
0 votes
0 answers
20 views

Selinux seems to be blocking but no denied message appearing in audit log

I have a script executed by a Java app with testmod_t context. This script does chage -M -1 user to set a user to no expiry. However, when SELinux is enforcing, the command does not seem to do ...
neffect's user avatar
1 vote
1 answer
59 views

Why does augenrules refuse to run even when sudo is used?

I have Amazon Linux 2023 running in a Docker container and I would like to be able to load some custom audit rules into the kernel and ensure they are persisted when the container restarts. I have ...
word4q's user avatar
  • 13
0 votes
1 answer
36 views

Audit service does not audit commands

OS sles 15, audit service enabled When I issue any command (for example, date or ls), I expect it to be logged in audit.log, something like this: type=SYSCALL msg=audit... type=EXECVE msg=audit(...
ibse's user avatar
  • 341
0 votes
0 answers
20 views

Auditd not logging certain user management events

I'm trying to track user management changes such as adding user to groups. I'm currently testing it on 2 machines and receive different results: Ubuntu 22.04.3 LTS (Jammy Jellyfish) Rocky Linux 9.2 (...
Janek Piotrowski's user avatar
0 votes
0 answers
19 views

Logs are not transferred to the Audit server

I have two virtual machines on Ubuntu. on the client machine the following Auditd settings: file: : /etc/audit/plugins.d/au-remote.conf active = yes direction = out path = /sbin/audisp-remote type = ...
Alex Rebell's user avatar
0 votes
0 answers
18 views

AuditD - tuning out parent and children

I'm reading over the AuditD readmes and I see how you can use filters but is there a way that you can tune out a parent and any activity they create along with their children processes? For example, I ...
Jason's user avatar
  • 1,744
3 votes
1 answer
143 views

SELinux does not log denial

SELinux does not allow auditd to start the process (named myplagin) and does not log the reason in the /var/log/audit/audit.log. The only mention of the denial I found in the /var/log/messages: ...
ibse's user avatar
  • 341
0 votes
1 answer
100 views

Audit log configuration solution

I have a RHEL server in which I have configured an audit rule to log a specific event. I wanted to forward those logs to a remote syslog server. I couldn't find a way to forward those specific logs so ...
Prateek Bansal's user avatar
0 votes
0 answers
51 views

auditd: re/load of rules on reboot only

Is this possible to configure auditd system from the LAS, only in a way that the rules are loaded after a reboot of the system? Currently the way it is, is that it needs a restart of the service ...
user avatar
0 votes
0 answers
57 views

Find most common offender in audit.log

I have a situation where a clean install of RHEL 8.8 and having auditd running with a given /etc/audit/rules.d/audit.rules file produces a /var/log/audit/audit.log that is greater than 4GB. This is ...
ron's user avatar
  • 7,264
2 votes
0 answers
79 views

SOCKET auditd hex value meaning

I have the following log messages from auditd. They appear to log calls to socket. type=SYSCALL msg=audit(05/11/2023 23:19:52.913:2533) : arch=x86_64 syscall=socket success=yes exit=9 a0=inet a1=...
Joel Olsteen's user avatar
1 vote
1 answer
346 views

audit does not record file events (but works for network events) in fedora

I want to monitor access to a file using audit, and hence added the following rule -w /home/test.txt -k monitoring-test I reloaded the rules (sudo service auditd restart) and modified the file /home/...
black's user avatar
  • 113
0 votes
0 answers
311 views

RHEL 9.1 - SELinux is preventing /usr/local/bin/php from read access on the file /web/inc/init_db.inc.php

i want to solve this problem what SELinux says. SELinux is preventing /usr/local/bin/php from read access on the file /web/inc/init_db.inc.php. output from console is: [root@rhel ~]# ausearch -c 'php'...
ArchMatt's user avatar
0 votes
0 answers
67 views

auditd does not record actiosn by apache/php

I have a PHP/Apache2-based webservice and I want to audit every file-IO action it does. I use auditd as recommended here. I set up audit.d like this ## enable ruleset -e 1 ## limit rate -r 1000 ## ...
Paflow's user avatar
  • 101
0 votes
1 answer
793 views

I'm using auditd, how to exclude auditd collect log about cron (ubuntu20.04)

I'm using auditd. I don't want to collect log about cron in auditd but it collect cron. If I don't want to collect aunditd log, how to make rule in audit.rules I wrote auditctl -a never,exit -F exe=/...
DarkerBlack's user avatar
0 votes
1 answer
208 views

Is it possible to filter or format the audit dmesg reports?

I like having a terminal open with dmesg so I can see the logs in real-time. However, the audit logs are quite long, and I was wondering if there was a way to filter messages (maybe with sed/awk?) ...
ZackT's user avatar
  • 13
0 votes
1 answer
752 views

AuditD - Log sudo access to /etc/passwd by all commands but never for other files

I'm struggling with the following task for AuditD /etc/passwd should be monitored for any access doesn't matter if a cat or sudo cat is used...ok, easy. BUT I should also prevent auditd to log any ...
SirStephanikus's user avatar
0 votes
1 answer
584 views

auditd does not save rules and overrides the edited rules after each deamon restart

I have auditd in Ubuntu and I'm trying to apply some rules but everytime I edit audit.rules file and restart auditd deamon it generates a new file. How can I keep the same file?
RickyLo's user avatar
0 votes
1 answer
837 views

Issue with file ACLs for /var/log/audit/audit.log

I have a service account that requires access to /var/log/audit/audit.log and since this user shouldn't be part of the root group nor do I want to change the ownership or group of the file, I decided ...
AnthonyBB's user avatar
  • 351
2 votes
1 answer
853 views

How to suppress PAM audit logs for RHEL8?

I have a system that is getting a ton of audit traffic for a particular account we will call 'redacted'. The logs are showing this account executing the su command. My first instinct was to check the ...
dennis123's user avatar
1 vote
0 answers
2k views

How does auditd get notified that the current audit.log is at its max size?

We recently realized that our current configuration for auditd was causing our /var/log/audit filesystem to become full so I started to play around with the /etc/audit/auditd.conf file to try to fix ...
Zack Schmidt's user avatar
0 votes
1 answer
1k views

LOAD, UNLOAD lines meaning in journal: /var/log/auth.log

I have many following lines in my journal file: /var/log/auth.log: Mar 4 09:34:39 hostname audit: AUDIT1334 prog-id=18 op=UNLOAD Mar 4 09:34:39 hostname audit: AUDIT1334 prog-id=17 op=...
mshta's user avatar
  • 1
0 votes
0 answers
984 views

auditd taking 199% CPU on CentOS7.6

I have a small VPS server running CentOS 7.6. Auditd repeatedly takes 199% CPU, basically rendering the system unusable. If I kill it, things calm down for a few days and then the problem returns. I'...
Michael Bar-Sinai's user avatar
0 votes
1 answer
87 views

How to monitor calls to stat?

I'd like to monitor calls to stat on any file within a directory. I know inotifywait can listen for file creation etc. but I don't know anything that can listen for stat. This is on Amazon Linux 2. ...
Johnny's user avatar
  • 101
1 vote
2 answers
868 views

Rsyslog - Parsing audit.log / omprog change log value

I'm trying to parse audit.log with rsyslog by using a bash script in order to transform the hex part of proctitle to ascii. However I do not get ressults: the file audit_ascii.log do not have lines ...
Oecophylla's user avatar
0 votes
0 answers
2k views

auditctl doesn't log anything

I am trying to find app/activity on a server for failed connection to external mysql host. For that I decided to use auditctl. I'm running the following command: [nir]$ sudo auditctl -A exit,always -F ...
Nir's user avatar
  • 1,375
0 votes
1 answer
2k views

auditd augenrules lost meaning

[root@rock:/var/log/audit] : service auditd status Redirecting to /bin/systemctl status auditd.service auditd.service - Security Auditing Service Loaded: loaded (/usr/lib/systemd/system/auditd....
ron's user avatar
  • 7,264
1 vote
0 answers
120 views

How to produce ANOM_EXEC event in auditd journal?

I am using Ubuntu 16, and want to produce ANOM_EXEC event in auditd journal, like such i found in internet: type=ANOM_EXEC msg=audit(1222174623.498:608): user pid=12965 uid=1 auid=2 ses=1 msg='op=PAM:...
Gudsaf's user avatar
  • 111
0 votes
0 answers
45 views

History of commands run by user after logging into root [duplicate]

I have a requirement to audit all the commands run by a user after he logs into root. Can anyone please help me with it. (for Suse-Linux) To explain even more simpler user alex logs into the server ...
Jay's user avatar
  • 19
0 votes
0 answers
269 views

internal logrotate mechanism in syslog-ng

Does the syslog-ng has its own rotating mechanism? I am new to auditing and linux and I though I could use logrotate but I noticed that I need to restart the syslog-ng daemon every time when I use it ...
lord_sommersby's user avatar
1 vote
0 answers
259 views

Auditd: reboot/login logs are not being added

I've configured auditd to monitor reboots/shutdowns/logins. Tried adding file system rules and syscall rules in a following way: -w /sbin/shutdown -p x -k power -w /sbin/poweroff -p x -k power -w /...
MarekMJM's user avatar
2 votes
1 answer
10k views

Linux Audit log rotation name and compression RHEL CentOS 7

Want to set either a weekly or monthly saving of the real-time /var/log/audit/audit.log file to a compressed file having the name such as audit_2020-05-05.log.gz In RHEL/CentOS 7.x is there an ...
ron's user avatar
  • 7,264
0 votes
1 answer
379 views

auditd / auditctl: Are chown and chmod “write” -w type of an operation?

Are chown and chmod “write” -w type of an operation? I'm using auditd to watch folder permissions. There are different options read, write, execute, attributes. I just want to watch chmod or chown ...
Dave Doga Oz's user avatar
1 vote
0 answers
125 views

Auditctl custom rules for groups

I'm running CentOS8 and I have 4 main groups in my system, I'm trying to create a rule that filters file modification by group. Like for example if the group operators changed my php configuration, I ...
Gwynn's user avatar
  • 41
0 votes
2 answers
306 views

Questions about audit

After executing the following instruction auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change it returned the following error -F ...
zebrakky's user avatar
1 vote
1 answer
1k views

Sniff password entered with read and passed as a command line argument

I'd like to show that entering passwords via read is insecure. To embed this into a half-way realistic scenario, let's say I use the following command to prompt the user for a password and have 7z¹ ...
Matthias Braun's user avatar
1 vote
1 answer
174 views

auditd exchange protocol

I'm currently working with auditd. It can be configured to send logs to a remote server using audispd. But instead of running another auditd instance on a target machine I just want to write my own ...
Hubert's user avatar
  • 111
0 votes
1 answer
942 views

rsyslog omprog when an audit logfile is rotated

We have an use case that we need to compress a logfile when it is rotated. More specifically we have the auditd audit trail that is rotated based on size... So when the size of the logfile reaches ...
zn553's user avatar
  • 1
1 vote
1 answer
344 views

CIS benchmark does not pass host configuration test

After adding below audit rules for docker artifacts: $ sudo auditctl -l -w /usr/bin/dockerd -p rwxa -k docker -w /var/lib/docker -p rwxa -k docker -w /etc/docker -p rwxa -k docker -w /lib/systemd/...
overexchange's user avatar
  • 1,546
1 vote
0 answers
831 views

ausearch not returning matches for AVC and sudo

I'm running auditd with a bunch of rules for PCI-DSS, but i have some anomalies. cat audit.log | grep type | grep AVC returns a bunch of entries like type=AVC msg=audit(1567154215.586:353): ...
placid chat's user avatar
2 votes
1 answer
565 views

How to configure auditd to collect logs from /proc

I've been looking for this for about 2 days and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk. To do this, I need to be able ...
Geordeaux's user avatar
2 votes
2 answers
718 views

SELinux security context of parent directories

I'm using a RHEL machine with SELinux enabled. I'd like to change the logfile position of auditd to /mydir/log/audit.log. I can apply the security context system_u:object_r:auditd_log_t:s0 to this ...
dr_'s user avatar
  • 30.1k
4 votes
1 answer
5k views

Auditd, Syslog and Journald

I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me. According to the things I read, auditd audits events in the ...
Eran Nahshon's user avatar
2 votes
1 answer
452 views

auditctl - logging the CPU or identifier of pthread that invoked the system call

auditctl is a great utility for monitoring many things, such as executed system calls. I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In ...
ricky116's user avatar
  • 121
1 vote
1 answer
3k views

FreeBSD: How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified?

How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified? Looking at the information here, i don't see how to accomplish the task. I'm trying to get a ...
jtlindsey's user avatar
  • 333
1 vote
1 answer
12k views

ausearch how to specify both time and date

I can run ausearch based on time: sudo ausearch --start '16:48:07' or date: sudo ausearch --start '05/07/2019' but not both: > sudo ausearch --start '05/07/2019 16:48:07' Invalid start time (...
jtpereyda's user avatar
  • 421
0 votes
1 answer
524 views

How to get type=USER_TTY record in audit.log?

What audit rule needs to be added to get USER_TTY record logged? Whether it will record all the executed commands under msg field?
fox18's user avatar
  • 15
0 votes
1 answer
2k views

How can we exclude results from users with tty=(none) in auditd?

Is there any way to exclude the event records having tty=(none) I have tried many ways of adding rule but nothing worked out. This is my current log file: > > type=SYSCALL msg=audit(...
fox18's user avatar
  • 15
0 votes
1 answer
384 views

how to extracting only few records from audit.log

How to Extract audit.log While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
fox18's user avatar
  • 15