Questions tagged [linux-audit]
Content related to the Linux Audit standard which is the most popular auditing tool used in GNU/Linux distributions.
108
questions
2
votes
0
answers
42
views
SOCKET auditd hex value meaning
I have the following log messages from auditd. They appear to log calls to socket.
type=SYSCALL msg=audit(05/11/2023 23:19:52.913:2533) :
arch=x86_64 syscall=socket success=yes exit=9
a0=inet a1=...
- 21
1
vote
1
answer
106
views
audit does not record file events (but works for network events) in fedora
I want to monitor access to a file using audit, and hence added the following rule
-w /home/test.txt -k monitoring-test
I reloaded the rules (sudo service auditd restart) and modified the file /home/...
- 113
0
votes
0
answers
142
views
RHEL 9.1 - SELinux is preventing /usr/local/bin/php from read access on the file /web/inc/init_db.inc.php
i want to solve this problem what SELinux says.
SELinux is preventing /usr/local/bin/php from read access on the file /web/inc/init_db.inc.php.
output from console is:
[root@rhel ~]# ausearch -c 'php'...
- 1
0
votes
0
answers
74
views
How to work with rsyslog mmpstrucdata and mmaudit plugins correctly
I need to convert audit logs into JSON formatted logs using rsyslog. so I tried different modules like mmprog, mmnormalize, mmjsonpars, mmpstrucdata, mmaudit. while testing those mmjsonpars and ...
- 1
0
votes
0
answers
63
views
run aureport for the previous month
The auditd report utility (aureport) has start/end options for this-month, this-week etc, but it seems in order to consistently produce a true monthly report 'this' month will always be incomplete ...
- 121
0
votes
0
answers
40
views
auditd does not record actiosn by apache/php
I have a PHP/Apache2-based webservice and I want to audit every file-IO action it does.
I use auditd as recommended here.
I set up audit.d like this
## enable ruleset
-e 1
## limit rate
-r 1000
## ...
- 101
0
votes
0
answers
63
views
Auditd - SOCKADDR - AF_LOCAL - Parsing issues
(Cross posted)
I set out to parse an auditd log entry containing a SOCKADDR event. I am running into issues with additional data and trying to identify where its coming from and the structure of it.
...
- 101
0
votes
1
answer
391
views
I'm using auditd, how to exclude auditd collect log about cron (ubuntu20.04)
I'm using auditd. I don't want to collect log about cron in auditd but it collect cron.
If I don't want to collect aunditd log, how to make rule in audit.rules
I wrote auditctl -a never,exit -F exe=/...
- 13
0
votes
1
answer
113
views
Is it possible to filter or format the audit dmesg reports?
I like having a terminal open with dmesg so I can see the logs in real-time. However, the audit logs are quite long, and I was wondering if there was a way to filter messages (maybe with sed/awk?) ...
- 13
0
votes
1
answer
362
views
AuditD - Log sudo access to /etc/passwd by all commands but never for other files
I'm struggling with the following task for AuditD
/etc/passwd should be monitored for any access doesn't matter if a cat or sudo cat is used...ok, easy. BUT I should also prevent auditd to log any ...
0
votes
1
answer
168
views
auditd does not save rules and overrides the edited rules after each deamon restart
I have auditd in Ubuntu and I'm trying to apply some rules but everytime I edit audit.rules file and restart auditd deamon it generates a new file. How can I keep the same file?
0
votes
1
answer
475
views
Issue with file ACLs for /var/log/audit/audit.log
I have a service account that requires access to /var/log/audit/audit.log and since this user shouldn't be part of the root group nor do I want to change the ownership or group of the file, I decided ...
- 351
1
vote
1
answer
562
views
How to suppress PAM audit logs for RHEL8?
I have a system that is getting a ton of audit traffic for a particular account we will call 'redacted'. The logs are showing this account executing the su command. My first instinct was to check the ...
- 25
1
vote
0
answers
954
views
How does auditd get notified that the current audit.log is at its max size?
We recently realized that our current configuration for auditd was causing our /var/log/audit filesystem to become full so I started to play around with the /etc/audit/auditd.conf file to try to fix ...
- 41
0
votes
1
answer
697
views
LOAD, UNLOAD lines meaning in journal: /var/log/auth.log
I have many following lines in my journal file: /var/log/auth.log:
Mar 4 09:34:39 hostname audit: AUDIT1334 prog-id=18 op=UNLOAD
Mar 4 09:34:39 hostname audit: AUDIT1334 prog-id=17 op=...
- 1
0
votes
0
answers
683
views
auditd taking 199% CPU on CentOS7.6
I have a small VPS server running CentOS 7.6. Auditd repeatedly takes 199% CPU, basically rendering the system unusable. If I kill it, things calm down for a few days and then the problem returns. I'...
0
votes
1
answer
70
views
How to monitor calls to stat?
I'd like to monitor calls to stat on any file within a directory. I know inotifywait can listen for file creation etc. but I don't know anything that can listen for stat. This is on Amazon Linux 2. ...
- 101
1
vote
2
answers
626
views
Rsyslog - Parsing audit.log / omprog change log value
I'm trying to parse audit.log with rsyslog by using a bash script in order to transform the hex part of proctitle to ascii. However I do not get ressults: the file audit_ascii.log do not have lines ...
- 11
0
votes
0
answers
1k
views
auditctl doesn't log anything
I am trying to find app/activity on a server for failed connection to external mysql host.
For that I decided to use auditctl. I'm running the following command:
[nir]$ sudo auditctl -A exit,always -F ...
- 1,285
0
votes
1
answer
1k
views
auditd augenrules lost meaning
[root@rock:/var/log/audit] : service auditd status
Redirecting to /bin/systemctl status auditd.service
auditd.service - Security Auditing Service
Loaded: loaded (/usr/lib/systemd/system/auditd....
- 5,806
1
vote
0
answers
88
views
How to produce ANOM_EXEC event in auditd journal?
I am using Ubuntu 16, and want to produce ANOM_EXEC event in auditd journal, like such i found in internet:
type=ANOM_EXEC msg=audit(1222174623.498:608): user pid=12965 uid=1
auid=2 ses=1 msg='op=PAM:...
- 111
0
votes
0
answers
44
views
History of commands run by user after logging into root [duplicate]
I have a requirement to audit all the commands run by a user after he logs into root. Can anyone please help me with it. (for Suse-Linux)
To explain even more simpler
user alex logs into the server ...
- 19
0
votes
0
answers
212
views
internal logrotate mechanism in syslog-ng
Does the syslog-ng has its own rotating mechanism?
I am new to auditing and linux and I though I could use logrotate but I noticed that I need to restart the syslog-ng daemon every time when I use it ...
1
vote
0
answers
194
views
Auditd: reboot/login logs are not being added
I've configured auditd to monitor reboots/shutdowns/logins. Tried adding file system rules and syscall rules in a following way:
-w /sbin/shutdown -p x -k power
-w /sbin/poweroff -p x -k power
-w /...
- 11
2
votes
1
answer
8k
views
Linux Audit log rotation name and compression RHEL CentOS 7
Want to set either a weekly or monthly saving of the real-time /var/log/audit/audit.log file to a compressed file having the name such as audit_2020-05-05.log.gz
In RHEL/CentOS 7.x is there an ...
- 5,806
0
votes
1
answer
286
views
auditd / auditctl: Are chown and chmod “write” -w type of an operation?
Are chown and chmod “write” -w type of an operation?
I'm using auditd to watch folder permissions. There are different options read, write, execute, attributes.
I just want to watch chmod or chown ...
- 119
1
vote
0
answers
109
views
Auditctl custom rules for groups
I'm running CentOS8 and I have 4 main groups in my system, I'm trying to create a rule that filters file modification by group. Like for example if the group operators changed my php configuration, I ...
- 41
0
votes
2
answers
284
views
Questions about audit
After executing the following instruction
auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change
it returned the following error
-F ...
- 1
1
vote
1
answer
831
views
Sniff password entered with read and passed as a command line argument
I'd like to show that entering passwords via read is insecure.
To embed this into a half-way realistic scenario, let's say I use the following command to prompt the user for a password and have 7z¹ ...
- 7,855
1
vote
1
answer
125
views
auditd exchange protocol
I'm currently working with auditd. It can be configured to send logs to a remote server using audispd.
But instead of running another auditd instance on a target machine I just want to write my own ...
- 111
0
votes
1
answer
755
views
rsyslog omprog when an audit logfile is rotated
We have an use case that we need to compress a logfile when it is rotated.
More specifically we have the auditd audit trail that is rotated based on size...
So when the size of the logfile reaches ...
- 1
1
vote
1
answer
338
views
CIS benchmark does not pass host configuration test
After adding below audit rules for docker artifacts:
$ sudo auditctl -l
-w /usr/bin/dockerd -p rwxa -k docker
-w /var/lib/docker -p rwxa -k docker
-w /etc/docker -p rwxa -k docker
-w /lib/systemd/...
- 1,476
1
vote
0
answers
599
views
ausearch not returning matches for AVC and sudo
I'm running auditd with a bunch of rules for PCI-DSS, but i have some anomalies.
cat audit.log | grep type | grep AVC
returns a bunch of entries like
type=AVC msg=audit(1567154215.586:353): ...
- 691
2
votes
1
answer
475
views
How to configure auditd to collect logs from /proc
I've been looking for this for about 2 days and have come up empty-handed.
I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk.
To do this, I need to be able ...
- 21
2
votes
2
answers
535
views
SELinux security context of parent directories
I'm using a RHEL machine with SELinux enabled.
I'd like to change the logfile position of auditd to /mydir/log/audit.log. I can apply the security context system_u:object_r:auditd_log_t:s0 to this ...
- 28.8k
4
votes
1
answer
4k
views
Auditd, Syslog and Journald
I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me.
According to the things I read, auditd audits events in the ...
- 41
2
votes
1
answer
392
views
auditctl - logging the CPU or identifier of pthread that invoked the system call
auditctl is a great utility for monitoring many things, such as executed system calls.
I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In ...
- 121
1
vote
1
answer
3k
views
FreeBSD: How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified?
How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified? Looking at the information here, i don't see how to accomplish the task.
I'm trying to get a ...
- 333
1
vote
1
answer
9k
views
ausearch how to specify both time and date
I can run ausearch based on time:
sudo ausearch --start '16:48:07'
or date:
sudo ausearch --start '05/07/2019'
but not both:
> sudo ausearch --start '05/07/2019 16:48:07'
Invalid start time (...
- 401
0
votes
1
answer
422
views
How to get type=USER_TTY record in audit.log?
What audit rule needs to be added to get USER_TTY record logged?
Whether it will record all the executed commands under msg field?
- 15
0
votes
1
answer
1k
views
How can we exclude results from users with tty=(none) in auditd?
Is there any way to exclude the event records having tty=(none)
I have tried many ways of adding rule but nothing worked out.
This is my current log file:
> > type=SYSCALL msg=audit(...
- 15
0
votes
1
answer
331
views
how to extracting only few records from audit.log
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
- 15
-1
votes
1
answer
3k
views
Auditing tool is not working in Kernel version 3.12.14
I am getting the following error while trying to start auditd sevice:
auditctl[2144]:Error - audit support not in kernel
auditctl[2144]:Cannot open netlink audit socket
auditctl[2144]:Started ...
- 15
1
vote
1
answer
815
views
No system call when malloc after free
While I was playing a little with kernel audit system, I made a small C program:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv){
void *t;
while(1){...
- 173
3
votes
1
answer
2k
views
how to find ssh key in audit log file?
i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works:
ssh-keygen
ssh-copy-id -i /root/.ssh/...
1
vote
0
answers
2k
views
How to capture ssh commands on the fly with auditd
There is any way to capture ssh commands executed by an user, on the fly with auditd?
The image exemplifies a case where a user send a command and auditd capture the command in execution time. At ...
- 644
0
votes
1
answer
2k
views
check auditd version
Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name?
For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
0
votes
2
answers
4k
views
Getting error when stopping auditd
I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
- 888
1
vote
0
answers
560
views
Why ausearch does not find matches for SYSTEM_BOOT and SYSTEM_SHUTDOWN?
I ask myself why I get no matches when I search for SYSTEM_BOOT or SYSTEM_SHUTDOWN.
ausearch -m SYSTEM_BOOT
ausearch -m SYSTEM_SHUTDOWN
To be sure that events are not getting lost during booting I ...
- 11
0
votes
1
answer
976
views
Is there an alternative to auditd enabling different log files per filters?
Auditd do not enable to log different filters in different files (cf man pages). Is there an alternative to it which makes it possible, in particular to separate accounts activities?
- 153