Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [linux-audit]

Content related to the Linux Audit standard which is the most popular auditing tool used in GNU/Linux distributions.

0
votes
0answers
26 views

C : what does “?” mean? [migrated]

1:snprintf( buf, sizeof(buf), 2: "%s exe=%s hostname=%s addr=%s terminal=%s res=%s", 3: message, exename, 4: hostname ? hostname : "?", 5: ...
0
votes
0answers
18 views

How can we exclude results from users with tty=(none) in auditd?

Is there any way to exclude the event records having tty=(none) I have tried many ways of adding rule but nothing worked out. This is my current log file: > > type=SYSCALL msg=audit(...
0
votes
1answer
25 views

how to extracting only few records from audit.log

How to Extract audit.log While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
-2
votes
1answer
48 views

Auditing tool is not working in Kernel version 3.12.14

I am getting the following error while trying to start auditd sevice: auditctl[2144]:Error - audit support not in kernel auditctl[2144]:Cannot open netlink audit socket auditctl[2144]:Started ...
1
vote
1answer
40 views

No system call when malloc after free

While I was playing a little with kernel audit system, I made a small C program: #include <stdio.h> #include <stdlib.h> int main(int argc, char** argv){ void *t; while(1){...
3
votes
1answer
131 views

how to find ssh key in audit log file?

i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works: ssh-keygen ssh-copy-id -i /root/.ssh/...
1
vote
0answers
63 views

How to capture ssh commands on the fly with auditd

There is any way to capture ssh commands executed by an user, on the fly with auditd? The image exemplifies a case where a user send a command and auditd capture the command in execution time. At ...
0
votes
1answer
72 views

check auditd version

Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name? For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
0
votes
0answers
69 views

'auditctl -l' output is different between different auditd version

I need to match a regex against the output of 'auditctl -l' command. From the several checks I conducted I saw a difference in output convention writing in different audit versions (for the same audit ...
0
votes
1answer
150 views

Getting error when stopping auditd

I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
1
vote
0answers
77 views

Why ausearch does not find matches for SYSTEM_BOOT and SYSTEM_SHUTDOWN?

I ask myself why I get no matches when I search for SYSTEM_BOOT or SYSTEM_SHUTDOWN. ausearch -m SYSTEM_BOOT ausearch -m SYSTEM_SHUTDOWN To be sure that events are not getting lost during booting I ...
0
votes
1answer
119 views

Is there an alternative to auditd enabling different log files per filters?

Auditd do not enable to log different filters in different files (cf man pages). Is there an alternative to it which makes it possible, in particular to separate accounts activities?
0
votes
1answer
59 views

aureport -l doesnt show the sucessful count of the user who used “su” command

why the command aureport -l --success --summary -i does show the successful login count of the user who used su command. The output the above said command only calculates sshd, gdm sessions but not ...
2
votes
1answer
464 views

Kernel / Boot auditing in RHEL 7?

In RHEL5 and RHEL6, I could add audit=1 to start kernel-level auditing during boot before the boot process got as far as starting auditd. Now, in RHEL7, I can't find any mention of audit=1 as a kernel ...
3
votes
0answers
162 views

Can aureport show the full path to files?

I'm tailing auditd.log and piping it into ausearch and then aureport, with the aim of getting a simple stream of modified files: tail -f /var/log/audit/audit.log | ausearch -k my_key | aureport -f --...
4
votes
1answer
117 views

Changes made with chattr are not detected by auditd

I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using: auditctl -w /etc/my_path_to_monitor -p wa -k my_rule This works great for everything ...
4
votes
0answers
95 views

What is the modern way to develop a Linux auditing kernel module?

I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports. I am aware of the things like ...
1
vote
0answers
102 views

auditd misses execution on some commands

I've placed an auditd rule on the jcmd command as follows: auditctl -w /usr/bin/jcmd -p x -k jvm_debug However, when I execute it, it writes nothing to log. Looking at guides and previous questions ...
0
votes
1answer
766 views

auditctl -l shows only few rules

i am using /etc/audit/rules.d/*.rules files to generate the /etc/audit/audit.rules which has 120 lines. But if i run auditctl -l i get only 14 lines as a result though. Why is this ...
0
votes
0answers
350 views

how to parse audit_cmd in auditd logs

I have some lines of auditd log that contains the key audit_cmd followed by a long string of hex. How can I parse it? Note: I might not be always on the machine that originally generated the logs (in ...
0
votes
1answer
54 views

How do I differentiate between, xterm and firefox, if both call syscall=socketcall(recvmsg)

---- type=PROCTITLE msg=audit(Sunday 03 September 2017 ^E.370:2020074) : proctitle=/usr/bin/xterm -fg white -bg black type=SOCKETCALL msg=audit(Sunday 03 September 2017 ^E.370:2020074) : nargs=3 a0=...
2
votes
0answers
205 views

Is it possible to have auditd log different rules in different log files?

I would like to have some rules logged in a file that is not the default log file defined in /etc/audit/auditd.conf. Is there a way to have auditd log some rules in a separate file? Something like -w ...
3
votes
0answers
56 views

Why does linux audit daemon restart periodically with the following log?

Sample Log : type=SERVICE_START msg=audit(1497515461.023:2020433): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="systemd-tmpfiles-clean" exe="/lib/systemd/systemd" hostname=? addr=? ...
0
votes
1answer
431 views

cronjob not redirecting output of command when used with option

I'm not able to redirect output of command into a file when ran with cronjob [root@mail /]# crontab -l */1 * * * * /sbin/ausearch -i > /rummy [root@mail /]# cat /rummy It's ...
2
votes
1answer
603 views

RHEL auditd rules -D

I've a confusion over RedHat entriprise linux audit rules. The audit.rules contains the following # This file contains the auditctl rules that are loaded # whenever the audit daemon is started via ...
1
vote
0answers
275 views

Enabling custom auditd logging in RedHat

I enabled the auditd service using the following configuration to trace all user activities (belonging to group ID 555) on RedHat OS: vim /etc/audit/audit.rules -a always,exit -F gid=555 -F arch=b64 -...
1
vote
0answers
70 views

Why does this `aureport` show a question mark in the 'exe' field?

I'm trying to debug why my docker socket changes ownership on a weekly basis. I created an audit log rule on /var/run/docker.sock. The audit report shows me many events happening to that socket, but ...
1
vote
0answers
261 views

Interpreting auditd logs part1

Recently, we've enabled auditd on one of our CentOS 7.3 servers and while reviewing some basic reports, I've noticed there's a ton of failed events, say around ~10K a day: # aureport -x --failed | ...
2
votes
1answer
641 views

how to run a script on auditd events?

I have configured auditd to track some sensitive files on my system. Now I would to have a script that will be called each time auditd writes a line, with the $1 argument of that script being the line ...
1
vote
0answers
331 views

How can I get auditd to report on ONLY the rules I specify with auditctl? (Linux)

Re-started system, cleared rule list with auditctl, but auditd still reports on stuff. Why? How do I add rules to report only on what I want? When I add a rule, other stuff is reported too. Note: I ...
3
votes
2answers
468 views

How do I dissect an SELinux SYSCALL message?

So, I have this trio of audit log entries type=AVC msg=audit(1488396169.095:2624951): avc: denied { setrlimit } for pid=16804 comm="bash" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:...
0
votes
1answer
297 views

auditd script through crontab - bad date

I did create a central auditd server where i'am sending all audit logs form local servers. I would like reports accesses from a specific node. So I created a simple report sript where one line is ...
2
votes
0answers
474 views

Audit and or monitor every command sent through an SSH connection?

I am writing because I need a way to monitor what my users send via ssh. I have a jumphost and I tried the following: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/...
4
votes
1answer
340 views

linux audit events not passed to go-audit

We're attempting to use slack's go-audit tool to capture/process linux audit events. More info: https://github.com/slackhq/go-audit The issue is that the linux audit is correctly picking up events, ...
1
vote
0answers
386 views

Why is the “wrong” process killed?

I am using auditd to monitor my system for kills. Normally I see the following pair of lines. As an example from a bash shell I have performed a kill -9 on a sleep command with pid 16207. As I ...
0
votes
1answer
567 views

Forward Auditd logs to one servers and analyze using aureport

I configured auditd in two RHEL servers with required rules. The audit logs are as expected. I want to forward these logs to a central server so that the analysis will be easy. I tried the two ...
1
vote
0answers
375 views

linux audit rules excluding based on type msg exe, for the su command

I have the below events that occur repeatedly in my audit.log. Can someone provide the valid syntax of the rule for the audit.rules file, that would prevent these 6 specific entries? Ideally I want ...
0
votes
1answer
286 views

Centos 7 --> Logging Failed Permission Changes By Another User?

I've been trying to figure this one out and it seems like a rather easier said than done situation. I am currently setting up a server that sends errors, failed logons, who accessed what and when, etc....
2
votes
0answers
1k views

linux audit repeating USER_ACCT CRED_ACQ LOGIN USER_START USER_END under cron

my system is Suse SLES 11.4 x86-64 and the following seems to be generated every minute. This is after a system reboot with much of everything turned off in chkconfig, including auditd. I start ...
1
vote
0answers
32 views

Audit is not watching /mnt/foo on RHEL4

======New info ===== On my RHEL4 system, auditctl is failing to watch only when something is mounted via the mount command. The same directory works fine when it is unmounted. The version of audit is ...
1
vote
0answers
113 views

Recording Commands Run by a User on RHEL5

I am trying to use pam_tty_audit to record every commands run by a user. I SSH into the RHEL5 host and run sudo -i and then appended session required pam_tty_audit.so disable=* enable=root ...
5
votes
1answer
7k views

How to send audit logs with audisp-remote and receive them with netcat

I am trying to configure a CentOS 7 running in VirtualBox to send its audit logs to the host which is FreeBSD 10.3. Ideally, I'd like to receive the logs with FreeBSD's auditdistd(8) but for now I'd ...
0
votes
1answer
198 views

Is the regex defining the arguments to the execve syscall in the Linux Audit standard still used?

According to the field dictionary[1] there are fields which names are defined by the following regex: a[[:digit:]+]\[.*\] I was able to find examples of fields like a4 and a5 (see 2) but it doesn't ...
1
vote
1answer
51 views

Where can I find the most recent dictionary of standard Linux Audit event fields?

I am writing a converter which takes Linux Audit logs as input. I tried to find the most recent dictionary file where all the valid names of the fields are defined. I've found such a file[1] but the ...
4
votes
1answer
949 views

Undocumented format of Linux Audit log records

I am writing a parser for Linux Audit and I stumbled upon some weird cases which doesn't seem to comply with the standard. My reference is the Red Hat's documentation. A proper audit record should ...
3
votes
1answer
127 views

Can I be sure that the name of a Linux Audit record's field is unique?

I am creating a parser/converter from the Linux Audit format. As I was studying the format, looking at examples and reading the documentation I stumbled upon a problem. Can I be sure that the field ...
2
votes
0answers
460 views

How to enable additional audit logging?

We use Auditd to monitor specific changes on Linux systems. Majority of our rules come from CIS Benchmark guidelines and then few are added specifically to monitor certain command executions. We have ...
4
votes
1answer
619 views

Identifying source of audit messages in kern.log

I recently installed the auditd package on my Debian machine. I did some testing with auditctl, creating a single rule to watch a directory, proved something, and then removed and purged auditd. ...
2
votes
1answer
665 views

aureport interpretting report output

I have ran the following command on my RHEL 6 system to produce an audit report aureport --login --summary -i that produces the following output Login Summary Report ============================ ...
3
votes
0answers
298 views

Replacement for auditd in OpenVZ

Are there any replacements for auditd to use in OpenVZ containers? ProxMox VE (pve-manager/3.4-6/102d4547 (running kernel: 2.6.32-39-pve)