Questions tagged [linux-audit]

Content related to the Linux Audit standard which is the most popular auditing tool used in GNU/Linux distributions.

Filter by
Sorted by
Tagged with
1 vote
1 answer
33 views

How to suppress PAM audit logs for RHEL8?

I have a system that is getting a ton of audit traffic for a particular account we will call 'redacted'. The logs are showing this account executing the su command. My first instinct was to check the ...
user avatar
1 vote
0 answers
32 views

How does auditd get notified that the current audit.log is at its max size?

We recently realized that our current configuration for auditd was causing our /var/log/audit filesystem to become full so I started to play around with the /etc/audit/auditd.conf file to try to fix ...
user avatar
0 votes
1 answer
24 views

LOAD, UNLOAD lines meaning in journal: /var/log/auth.log

I have many following lines in my journal file: /var/log/auth.log: Mar 4 09:34:39 hostname audit: AUDIT1334 prog-id=18 op=UNLOAD Mar 4 09:34:39 hostname audit: AUDIT1334 prog-id=17 op=...
user avatar
  • 1
0 votes
0 answers
116 views

auditd taking 199% CPU on CentOS7.6

I have a small VPS server running CentOS 7.6. Auditd repeatedly takes 199% CPU, basically rendering the system unusable. If I kill it, things calm down for a few days and then the problem returns. I'...
user avatar
0 votes
1 answer
35 views

How to monitor calls to stat?

I'd like to monitor calls to stat on any file within a directory. I know inotifywait can listen for file creation etc. but I don't know anything that can listen for stat. This is on Amazon Linux 2. ...
user avatar
  • 101
1 vote
2 answers
138 views

Rsyslog - Parsing audit.log / omprog change log value

I'm trying to parse audit.log with rsyslog by using a bash script in order to transform the hex part of proctitle to ascii. However I do not get ressults: the file audit_ascii.log do not have lines ...
user avatar
0 votes
0 answers
94 views

Enable full syscall auditing on Fedora for better SELinux AVC messages

When searching for SELinux AVCs one often finds the advice to enable full syscall auditing in order to path information attached to an AVC. For example, when debugging dac_override AVCs. For sure, by ...
user avatar
  • 52.9k
0 votes
0 answers
38 views

Auditd - log systemcall execve on path

I want Auditd to log every program that is executed from a defined path. I already add the rules to log every execution in the rules file: -a exit,always -F arch=b32 -S execve -k exec32 -a exit,always ...
user avatar
  • 1
0 votes
0 answers
444 views

auditctl doesn't log anything

I am trying to find app/activity on a server for failed connection to external mysql host. For that I decided to use auditctl. I'm running the following command: [nir]$ sudo auditctl -A exit,always -F ...
user avatar
  • 1,135
0 votes
1 answer
471 views

auditd augenrules lost meaning

[root@rock:/var/log/audit] : service auditd status Redirecting to /bin/systemctl status auditd.service auditd.service - Security Auditing Service Loaded: loaded (/usr/lib/systemd/system/auditd....
user avatar
  • 4,121
1 vote
0 answers
46 views

How to produce ANOM_EXEC event in auditd journal?

I am using Ubuntu 16, and want to produce ANOM_EXEC event in auditd journal, like such i found in internet: type=ANOM_EXEC msg=audit(1222174623.498:608): user pid=12965 uid=1 auid=2 ses=1 msg='op=PAM:...
user avatar
  • 111
0 votes
0 answers
43 views

History of commands run by user after logging into root [duplicate]

I have a requirement to audit all the commands run by a user after he logs into root. Can anyone please help me with it. (for Suse-Linux) To explain even more simpler user alex logs into the server ...
user avatar
  • 19
0 votes
0 answers
106 views

internal logrotate mechanism in syslog-ng

Does the syslog-ng has its own rotating mechanism? I am new to auditing and linux and I though I could use logrotate but I noticed that I need to restart the syslog-ng daemon every time when I use it ...
user avatar
1 vote
0 answers
97 views

Auditd: reboot/login logs are not being added

I've configured auditd to monitor reboots/shutdowns/logins. Tried adding file system rules and syscall rules in a following way: -w /sbin/shutdown -p x -k power -w /sbin/poweroff -p x -k power -w /...
user avatar
0 votes
1 answer
5k views

Linux Audit log rotation name and compression RHEL CentOS 7

Want to set either a weekly or monthly saving of the real-time /var/log/audit/audit.log file to a compressed file having the name such as audit_2020-05-05.log.gz In RHEL/CentOS 7.x is there an ...
user avatar
  • 4,121
0 votes
1 answer
146 views

auditd / auditctl: Are chown and chmod “write” -w type of an operation?

Are chown and chmod “write” -w type of an operation? I'm using auditd to watch folder permissions. There are different options read, write, execute, attributes. I just want to watch chmod or chown ...
user avatar
1 vote
0 answers
64 views

Auditctl custom rules for groups

I'm running CentOS8 and I have 4 main groups in my system, I'm trying to create a rule that filters file modification by group. Like for example if the group operators changed my php configuration, I ...
user avatar
  • 41
0 votes
2 answers
245 views

Questions about audit

After executing the following instruction auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change it returned the following error -F ...
user avatar
1 vote
1 answer
441 views

Sniff password entered with read and passed as a command line argument

I'd like to show that entering passwords via read is insecure. To embed this into a half-way realistic scenario, let's say I use the following command to prompt the user for a password and have 7z¹ ...
user avatar
1 vote
1 answer
68 views

auditd exchange protocol

I'm currently working with auditd. It can be configured to send logs to a remote server using audispd. But instead of running another auditd instance on a target machine I just want to write my own ...
user avatar
  • 111
0 votes
1 answer
439 views

rsyslog omprog when an audit logfile is rotated

We have an use case that we need to compress a logfile when it is rotated. More specifically we have the auditd audit trail that is rotated based on size... So when the size of the logfile reaches ...
user avatar
  • 1
1 vote
1 answer
324 views

CIS benchmark does not pass host configuration test

After adding below audit rules for docker artifacts: $ sudo auditctl -l -w /usr/bin/dockerd -p rwxa -k docker -w /var/lib/docker -p rwxa -k docker -w /etc/docker -p rwxa -k docker -w /lib/systemd/...
user avatar
  • 1,256
1 vote
0 answers
352 views

ausearch not returning matches for AVC and sudo

I'm running auditd with a bunch of rules for PCI-DSS, but i have some anomalies. cat audit.log | grep type | grep AVC returns a bunch of entries like type=AVC msg=audit(1567154215.586:353): ...
user avatar
2 votes
1 answer
366 views

How to configure auditd to collect logs from /proc

I've been looking for this for about 2 days and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk. To do this, I need to be able ...
user avatar
2 votes
2 answers
314 views

SELinux security context of parent directories

I'm using a RHEL machine with SELinux enabled. I'd like to change the logfile position of auditd to /mydir/log/audit.log. I can apply the security context system_u:object_r:auditd_log_t:s0 to this ...
user avatar
  • 25.4k
3 votes
1 answer
2k views

Auditd, Syslog and Journald

I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me. According to the things I read, auditd audits events in the ...
user avatar
2 votes
1 answer
263 views

auditctl - logging the CPU or identifier of pthread that invoked the system call

auditctl is a great utility for monitoring many things, such as executed system calls. I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In ...
user avatar
  • 121
1 vote
1 answer
2k views

FreeBSD: How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified?

How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified? Looking at the information here, i don't see how to accomplish the task. I'm trying to get a ...
user avatar
  • 303
1 vote
1 answer
5k views

ausearch how to specify both time and date

I can run ausearch based on time: sudo ausearch --start '16:48:07' or date: sudo ausearch --start '05/07/2019' but not both: > sudo ausearch --start '05/07/2019 16:48:07' Invalid start time (...
user avatar
  • 361
0 votes
1 answer
250 views

How to get type=USER_TTY record in audit.log?

What audit rule needs to be added to get USER_TTY record logged? Whether it will record all the executed commands under msg field?
user avatar
  • 5
0 votes
1 answer
849 views

How can we exclude results from users with tty=(none) in auditd?

Is there any way to exclude the event records having tty=(none) I have tried many ways of adding rule but nothing worked out. This is my current log file: > > type=SYSCALL msg=audit(...
user avatar
  • 5
0 votes
1 answer
236 views

how to extracting only few records from audit.log

How to Extract audit.log While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
user avatar
  • 5
-2 votes
1 answer
2k views

Auditing tool is not working in Kernel version 3.12.14

I am getting the following error while trying to start auditd sevice: auditctl[2144]:Error - audit support not in kernel auditctl[2144]:Cannot open netlink audit socket auditctl[2144]:Started ...
user avatar
  • 5
1 vote
1 answer
495 views

No system call when malloc after free

While I was playing a little with kernel audit system, I made a small C program: #include <stdio.h> #include <stdlib.h> int main(int argc, char** argv){ void *t; while(1){...
user avatar
3 votes
1 answer
2k views

how to find ssh key in audit log file?

i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works: ssh-keygen ssh-copy-id -i /root/.ssh/...
user avatar
1 vote
0 answers
1k views

How to capture ssh commands on the fly with auditd

There is any way to capture ssh commands executed by an user, on the fly with auditd? The image exemplifies a case where a user send a command and auditd capture the command in execution time. At ...
user avatar
  • 634
0 votes
1 answer
1k views

check auditd version

Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name? For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
user avatar
0 votes
2 answers
3k views

Getting error when stopping auditd

I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
user avatar
  • 868
1 vote
0 answers
382 views

Why ausearch does not find matches for SYSTEM_BOOT and SYSTEM_SHUTDOWN?

I ask myself why I get no matches when I search for SYSTEM_BOOT or SYSTEM_SHUTDOWN. ausearch -m SYSTEM_BOOT ausearch -m SYSTEM_SHUTDOWN To be sure that events are not getting lost during booting I ...
user avatar
  • 11
0 votes
1 answer
679 views

Is there an alternative to auditd enabling different log files per filters?

Auditd do not enable to log different filters in different files (cf man pages). Is there an alternative to it which makes it possible, in particular to separate accounts activities?
user avatar
  • 153
0 votes
1 answer
160 views

aureport -l doesnt show the sucessful count of the user who used "su" command

why the command aureport -l --success --summary -i does show the successful login count of the user who used su command. The output the above said command only calculates sshd, gdm sessions but not ...
user avatar
  • 31
2 votes
1 answer
2k views

Kernel / Boot auditing in RHEL 7?

In RHEL5 and RHEL6, I could add audit=1 to start kernel-level auditing during boot before the boot process got as far as starting auditd. Now, in RHEL7, I can't find any mention of audit=1 as a kernel ...
user avatar
  • 1,376
4 votes
1 answer
708 views

Can aureport show the full path to files?

I'm tailing auditd.log and piping it into ausearch and then aureport, with the aim of getting a simple stream of modified files: tail -f /var/log/audit/audit.log | ausearch -k my_key | aureport -f --...
user avatar
  • 173
3 votes
1 answer
366 views

Changes made with chattr are not detected by auditd

I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using: auditctl -w /etc/my_path_to_monitor -p wa -k my_rule This works great for everything ...
user avatar
  • 173
4 votes
0 answers
164 views

What is the modern way to develop a Linux auditing kernel module?

I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports. I am aware of the things like ...
user avatar
  • 141
1 vote
0 answers
279 views

auditd misses execution on some commands

I've placed an auditd rule on the jcmd command as follows: auditctl -w /usr/bin/jcmd -p x -k jvm_debug However, when I execute it, it writes nothing to log. Looking at guides and previous questions ...
user avatar
  • 800
0 votes
1 answer
4k views

auditctl -l shows only few rules

i am using /etc/audit/rules.d/*.rules files to generate the /etc/audit/audit.rules which has 120 lines. But if i run auditctl -l i get only 14 lines as a result though. Why is this ...
user avatar
1 vote
1 answer
2k views

How to parse audit_cmd in auditd logs?

I have some lines of auditd.log that contains the key audit_cmd followed by a long string of HEX. type=USER_CMD msg=audit(<TIMESTAMP>): pid=<PID> uid=<UID> auid=<AUID> ses=...
user avatar
  • 800
0 votes
1 answer
98 views

How do I differentiate between, xterm and firefox, if both call syscall=socketcall(recvmsg)

---- type=PROCTITLE msg=audit(Sunday 03 September 2017 ^E.370:2020074) : proctitle=/usr/bin/xterm -fg white -bg black type=SOCKETCALL msg=audit(Sunday 03 September 2017 ^E.370:2020074) : nargs=3 a0=...
user avatar
2 votes
0 answers
421 views

Is it possible to have auditd log different rules in different log files?

I would like to have some rules logged in a file that is not the default log file defined in /etc/audit/auditd.conf. Is there a way to have auditd log some rules in a separate file? Something like -w ...
user avatar
  • 800