Questions tagged [linux-audit]
Content related to the Linux Audit standard which is the most popular auditing tool used in GNU/Linux distributions.
0
votes
1answer
31 views
FreeBSD: How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified?
How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified? Looking at the information here, i don't see how to accomplish the task.
I'm trying to get a ...
0
votes
1answer
9 views
ausearch how to specify both time and date
I can run ausearch based on time:
sudo ausearch --start '16:48:07'
or date:
sudo ausearch --start '05/07/2019'
but not both:
> sudo ausearch --start '05/07/2019 16:48:07'
Invalid start time (...
0
votes
1answer
17 views
How to get type=USER_TTY record in audit.log
What audit rule to be added to get USER_TTY record
whether it will record all the executed commands under msg field?
0
votes
0answers
28 views
How can we exclude results from users with tty=(none) in auditd?
Is there any way to exclude the event records having tty=(none)
I have tried many ways of adding rule but nothing worked out.
This is my current log file:
> > type=SYSCALL msg=audit(...
0
votes
1answer
25 views
how to extracting only few records from audit.log
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
-2
votes
1answer
67 views
Auditing tool is not working in Kernel version 3.12.14
I am getting the following error while trying to start auditd sevice:
auditctl[2144]:Error - audit support not in kernel
auditctl[2144]:Cannot open netlink audit socket
auditctl[2144]:Started ...
1
vote
1answer
45 views
No system call when malloc after free
While I was playing a little with kernel audit system, I made a small C program:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv){
void *t;
while(1){...
3
votes
1answer
169 views
how to find ssh key in audit log file?
i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works:
ssh-keygen
ssh-copy-id -i /root/.ssh/...
1
vote
0answers
72 views
How to capture ssh commands on the fly with auditd
There is any way to capture ssh commands executed by an user, on the fly with auditd?
The image exemplifies a case where a user send a command and auditd capture the command in execution time. At ...
0
votes
1answer
82 views
check auditd version
Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name?
For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
0
votes
0answers
79 views
'auditctl -l' output is different between different auditd version
I need to match a regex against the output of 'auditctl -l' command.
From the several checks I conducted I saw a difference in output convention writing in different audit versions (for the same audit ...
0
votes
1answer
193 views
Getting error when stopping auditd
I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
1
vote
0answers
89 views
Why ausearch does not find matches for SYSTEM_BOOT and SYSTEM_SHUTDOWN?
I ask myself why I get no matches when I search for SYSTEM_BOOT or SYSTEM_SHUTDOWN.
ausearch -m SYSTEM_BOOT
ausearch -m SYSTEM_SHUTDOWN
To be sure that events are not getting lost during booting I ...
0
votes
1answer
145 views
Is there an alternative to auditd enabling different log files per filters?
Auditd do not enable to log different filters in different files (cf man pages). Is there an alternative to it which makes it possible, in particular to separate accounts activities?
0
votes
1answer
62 views
aureport -l doesnt show the sucessful count of the user who used “su” command
why the command aureport -l --success --summary -i does show the successful login count of the user who used su command.
The output the above said command only calculates sshd, gdm sessions but not ...
2
votes
1answer
498 views
Kernel / Boot auditing in RHEL 7?
In RHEL5 and RHEL6, I could add audit=1 to start kernel-level auditing during boot before the boot process got as far as starting auditd. Now, in RHEL7, I can't find any mention of audit=1 as a kernel ...
3
votes
0answers
171 views
Can aureport show the full path to files?
I'm tailing auditd.log and piping it into ausearch and then aureport, with the aim of getting a simple stream of modified files:
tail -f /var/log/audit/audit.log | ausearch -k my_key | aureport -f --...
3
votes
1answer
118 views
Changes made with chattr are not detected by auditd
I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using:
auditctl -w /etc/my_path_to_monitor -p wa -k my_rule
This works great for everything ...
4
votes
0answers
95 views
What is the modern way to develop a Linux auditing kernel module?
I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports.
I am aware of the things like ...
1
vote
0answers
111 views
auditd misses execution on some commands
I've placed an auditd rule on the jcmd command as follows:
auditctl -w /usr/bin/jcmd -p x -k jvm_debug
However, when I execute it, it writes nothing to log.
Looking at guides and previous questions ...
0
votes
1answer
816 views
auditctl -l shows only few rules
i am using
/etc/audit/rules.d/*.rules
files to generate the
/etc/audit/audit.rules
which has 120 lines.
But if i run
auditctl -l
i get only 14 lines as a result though.
Why is this ...
0
votes
0answers
368 views
how to parse audit_cmd in auditd logs
I have some lines of auditd log that contains the key audit_cmd followed by a long string of hex. How can I parse it?
Note: I might not be always on the machine that originally generated the logs (in ...
0
votes
1answer
55 views
How do I differentiate between, xterm and firefox, if both call syscall=socketcall(recvmsg)
---- type=PROCTITLE msg=audit(Sunday 03
September 2017 ^E.370:2020074) : proctitle=/usr/bin/xterm -fg white -bg
black type=SOCKETCALL msg=audit(Sunday 03 September 2017 ^E.370:2020074)
: nargs=3 a0=...
2
votes
0answers
213 views
Is it possible to have auditd log different rules in different log files?
I would like to have some rules logged in a file that is not the default log file defined in /etc/audit/auditd.conf. Is there a way to have auditd log some rules in a separate file?
Something like -w ...
3
votes
0answers
57 views
Why does linux audit daemon restart periodically with the following log?
Sample Log :
type=SERVICE_START msg=audit(1497515461.023:2020433): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="systemd-tmpfiles-clean" exe="/lib/systemd/systemd" hostname=? addr=? ...
0
votes
1answer
441 views
cronjob not redirecting output of command when used with option
I'm not able to redirect output of command into a file when ran with cronjob
[root@mail /]# crontab -l
*/1 * * * * /sbin/ausearch -i > /rummy
[root@mail /]# cat /rummy
It's ...
2
votes
1answer
624 views
RHEL auditd rules -D
I've a confusion over RedHat entriprise linux audit rules.
The audit.rules contains the following
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via ...
1
vote
0answers
279 views
Enabling custom auditd logging in RedHat
I enabled the auditd service using the following configuration to trace all user activities (belonging to group ID 555) on RedHat OS:
vim /etc/audit/audit.rules
-a always,exit -F gid=555 -F arch=b64 -...
1
vote
0answers
77 views
Why does this `aureport` show a question mark in the 'exe' field?
I'm trying to debug why my docker socket changes ownership on a weekly basis.
I created an audit log rule on /var/run/docker.sock.
The audit report shows me many events happening to that socket, but ...
1
vote
0answers
271 views
Interpreting auditd logs part1
Recently, we've enabled auditd on one of our CentOS 7.3 servers and while reviewing some basic reports, I've noticed there's a ton of failed events, say around ~10K a day:
# aureport -x --failed | ...
2
votes
1answer
659 views
how to run a script on auditd events?
I have configured auditd to track some sensitive files on my system. Now I would to have a script that will be called each time auditd writes a line, with the $1 argument of that script being the line ...
1
vote
0answers
342 views
How can I get auditd to report on ONLY the rules I specify with auditctl? (Linux)
Re-started system, cleared rule list with auditctl, but auditd still reports on stuff. Why? How do I add rules to report only on what I want? When I add a rule, other stuff is reported too. Note: I ...
3
votes
2answers
481 views
How do I dissect an SELinux SYSCALL message?
So, I have this trio of audit log entries
type=AVC msg=audit(1488396169.095:2624951): avc: denied { setrlimit } for pid=16804 comm="bash" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:...
0
votes
1answer
310 views
auditd script through crontab - bad date
I did create a central auditd server where i'am sending all audit logs form local servers.
I would like reports accesses from a specific node.
So I created a simple report sript where one line is ...
2
votes
0answers
488 views
Audit and or monitor every command sent through an SSH connection?
I am writing because I need a way to monitor what my users send via ssh.
I have a jumphost and I tried the following:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/...
4
votes
1answer
350 views
linux audit events not passed to go-audit
We're attempting to use slack's go-audit tool to capture/process linux audit events. More info: https://github.com/slackhq/go-audit
The issue is that the linux audit is correctly picking up events, ...
1
vote
0answers
399 views
Why is the “wrong” process killed?
I am using auditd to monitor my system for kills.
Normally I see the following pair of lines. As an example from a bash shell I have performed a kill -9 on a sleep command with pid 16207.
As I ...
0
votes
1answer
577 views
Forward Auditd logs to one servers and analyze using aureport
I configured auditd in two RHEL servers with required rules. The audit logs are as expected.
I want to forward these logs to a central server so that the analysis will be easy.
I tried the two ...
1
vote
0answers
384 views
linux audit rules excluding based on type msg exe, for the su command
I have the below events that occur repeatedly in my audit.log.
Can someone provide the valid syntax of the rule for the audit.rules file, that would prevent these 6 specific entries?
Ideally I want ...
0
votes
1answer
296 views
Centos 7 --> Logging Failed Permission Changes By Another User?
I've been trying to figure this one out and it seems like a rather easier said than done situation. I am currently setting up a server that sends errors, failed logons, who accessed what and when, etc....
2
votes
0answers
1k views
linux audit repeating USER_ACCT CRED_ACQ LOGIN USER_START USER_END under cron
my system is Suse SLES 11.4 x86-64 and the following seems to be generated every minute. This is after a system reboot with much of everything turned off in chkconfig, including auditd.
I start ...
1
vote
0answers
32 views
Audit is not watching /mnt/foo on RHEL4
======New info =====
On my RHEL4 system, auditctl is failing to watch only when something is mounted via the mount command. The same directory works fine when it is unmounted. The version of audit is ...
1
vote
0answers
115 views
Recording Commands Run by a User on RHEL5
I am trying to use pam_tty_audit to record every commands run by a user. I SSH into the RHEL5 host and run sudo -i and then appended
session required pam_tty_audit.so disable=* enable=root
...
5
votes
1answer
7k views
How to send audit logs with audisp-remote and receive them with netcat
I am trying to configure a CentOS 7 running in VirtualBox to send its audit logs to the host which is FreeBSD 10.3. Ideally, I'd like to receive the logs with FreeBSD's auditdistd(8) but for now I'd ...
0
votes
1answer
206 views
Is the regex defining the arguments to the execve syscall in the Linux Audit standard still used?
According to the field dictionary[1] there are fields which names are defined by the following regex:
a[[:digit:]+]\[.*\]
I was able to find examples of fields like a4 and a5 (see 2) but it doesn't ...
1
vote
1answer
51 views
Where can I find the most recent dictionary of standard Linux Audit event fields?
I am writing a converter which takes Linux Audit logs as input. I tried to find the most recent dictionary file where all the valid names of the fields are defined.
I've found such a file[1] but the ...
4
votes
1answer
971 views
Undocumented format of Linux Audit log records
I am writing a parser for Linux Audit and I stumbled upon some weird cases which doesn't seem to comply with the standard.
My reference is the Red Hat's documentation.
A proper audit record should ...
3
votes
1answer
129 views
Can I be sure that the name of a Linux Audit record's field is unique?
I am creating a parser/converter from the Linux Audit format. As I was studying the format, looking at examples and reading the documentation I stumbled upon a problem.
Can I be sure that the field ...
2
votes
0answers
469 views
How to enable additional audit logging?
We use Auditd to monitor specific changes on Linux systems. Majority of our rules come from CIS Benchmark guidelines and then few are added specifically to monitor certain command executions.
We have ...
4
votes
1answer
636 views
Identifying source of audit messages in kern.log
I recently installed the auditd package on my Debian machine. I did some testing with auditctl, creating a single rule to watch a directory, proved something, and then removed and purged auditd.
...
