auditd is the userspace component to the Linux Auditing System.

learn more… | top users | synonyms

0
votes
1answer
13 views

auditctl buffer setting - how large is this?

Within the default audit.rules file on CentOS 5, 6 and 7, the following is set: # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 However, there is no ...
1
vote
0answers
11 views

Auditing in linux

I am trying to setup a robust auditing mechanism on my centos 6.x boxes. I tried and tested various auditing tools like auditd aide psacct But none is full filling my requirement. My requirement ...
0
votes
0answers
6 views

Why is audispd dropping events? What is in the queue?

My audispd keeps logging lots of queue full errors. Jun 9 08:46:29 web audispd: queue is full - dropping event I'd like to understand better why the queue is filling up and whether there is a ...
0
votes
0answers
25 views

auditd process stops logging after logrotate script runs

I am trying to use logrotate to keep audit logs for a set period of time rather than using auditd's special rotation (from /etc/audit/auditd.conf). I have changed the max_log_file_action to IGNORE in ...
0
votes
0answers
51 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...
0
votes
0answers
33 views

Samba module full_audit is logging actions that didn't occured

Our company has a file server, a Debian Squeeze 64 bits, sharing some folders to Linux servers using NFSv2 and to Windows workstations using Samba. I want to log access to a specific set of shared ...
0
votes
0answers
26 views

Folder keeps getting deleted and I can't find out why

I have a Joomla based website running on CentOS, Apache, PHP, MySQL. I am using plupload file uploader to upload the files. I'm uploading the files to /tmp/uploads directory where they are processed ...
0
votes
0answers
86 views

How do I get auditd to push messages to a remote syslog server on Centos 6.6?

I'm a Windows guy trying to help a friend out. We need to get file auditing data off the Centos 6.6 server to a central syslog server. I found the auditd service and the audisp plugin. I edited the ...
1
vote
2answers
91 views

auditd execve arguments that looks like encoded data

I'm logging all execve's in a sort of honey pot box and as such I try to make sense of the commands. There's many many of these, all with 'bash -c' and some long alpha numerical value not enclosed in ...
1
vote
1answer
108 views

How to find out PID of the process sending packets (generating network traffic)?

Couple of weeks ago I had an issue where I changed DNS addresses in large network of around 300 nodes. After that, some of the nodes still continued to ask old DNS servers, although resolv.conf was ...
0
votes
0answers
42 views

SELinux - centos 6.5 run_init asks for password of non privileged user

I log onto my aws centos instance, as user: [user@aws-sonar-01 ~]$ sudo -i [root@aws-sonar-01 ~]# run_init /bin/bash -x -c 'ulimit -S -c 0 ; auditd'; echo $? Authenticating user. Password: + ulimit ...
2
votes
2answers
1k views

Centos 6.5 auditd fails to start with service or /etc/init.d/audit start

Fail: # service auditd start Starting auditd: [FAILED] Fail: # /etc/init.d/auditd start Starting auditd: ...
0
votes
1answer
36 views

Logging SFTP activity with auditd

I am currently using auditd to log TTY activity for users that are SSH'd into my system. However, SFTP sessions are not logged in this way. Is there a way to log them using auditd or will I need to ...
0
votes
1answer
80 views

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset ...
0
votes
0answers
71 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
0
votes
0answers
20 views

Auditd on VM - disappearing rules

I have FTP virtual server on ESX with two virtual hard disks. That hard disk is a vmdk files on data store, not on local storage of VM host. One virtual hard disk is for system, second for FTP shares. ...
0
votes
3answers
159 views

Track any file changes using auditd

I try configure PCI REQ 10.5.5 "Use file integrity monitoring or change detection software on logs" Use auditd for this, rule "auditctl -w /tmp/testfile -p war" works perfectly. But if I try to use ...
0
votes
0answers
1k views

Disable auditd immutable mode without rebooting

Hello I've been tasked with fixing up a auditd policy but it's on a server that's actively being used and the policy installed was set immutable. I've tried searching and everyone recommends rebooting ...
1
vote
1answer
44 views

How to properly look for an info about auditd being turned off from init?

I have a mystery on my hands. One day /etc/rc5.d/S11auditd became /etc/rc5.d/K88auditd and no one takes responsibility for it. It looks like it just happened by itself, which is hardly plausible and ...
1
vote
1answer
171 views

Ignore specific types with auditd

I've recently been playing around with auditd and trying to cut out some of what it is logging. Here is my audit.rules entry to log execve # First rule - delete all -D -a always,exit -F arch=b64 -S ...
2
votes
1answer
368 views

log bash command centralized server or any auditd saas [duplicate]

I'm looking for a way to track our sysmin work, in the servers. Lets say sysmin 1 and sysmin 2 have access to any server but we need to make sure and track anything that they do in our server. ...
1
vote
0answers
83 views

How can I get auditd on RHEL6 to dispatch forwarded messages?

Using RHEL6, I currently have audispd setup to send logs to a remote server. The remote server successfully receives the messages, and writes them to the remote audit log. My problem is, I can't seem ...
0
votes
1answer
90 views

Logging violations of rules in limits.conf

I am trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
2
votes
1answer
3k views

How to install auditd on CentOS?

How to install auditd on CentOS 6.4 x64 ? I want to Log all commands run by admins Log all commands run by admins on production servers Edit: I can't run aduditd service I did with this tut enter ...
1
vote
1answer
97 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
1
vote
1answer
740 views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...
2
votes
1answer
85 views

Sudden new S11auditd in /etc/rc3.d

We have several machines running under Fedora 12. We have to deal with complete reinstallation quite often as our product comes with the whole distibution. I've noticed that sometimes soon after new ...
2
votes
1answer
467 views

Using auditd to watch a directory non-recursively?

I'm working on a Cent 6 Cpanel machine, and some mystery script is changing the permissions of home directories (!) to 777. I've ruled out all the easy fixes, so I just need to set up a watch on the ...
4
votes
2answers
668 views

Getting auditd to record the original user

This question is related to my previous question: Log all commands run by admins on production servers It is company policy for admins to login to the servers via a personal username, and then run ...
0
votes
1answer
564 views

How to check which processes are deleting files without using inotify or auditd? [closed]

I'm trying to figure out which processes are deleting files from a specific directory on my CentOS server. I looked at inotify, but all this does is to tell me how many file deletions are occurring; ...
2
votes
2answers
380 views

How to figure out which processes are deleting files from a specific directory?

I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system. I've set up the following rule in audit.rules: -w S unlink -S ...
2
votes
0answers
141 views

difference between success and failed event in auditd/aureport

The aureport command has two options that limit the list of displayed events to those that were successful and those that failed. Per the man page: --failed Only select failed events ...
1
vote
0answers
195 views

Unexpected jBoss crash and auditing signals

We're experiencing unexpected JBoss crashes on a semi-regular basis. JBoss 5 is running on RHEL6 in this case. I believe this is related to a sigusr1 sent to the JBoss process. The JBoss server logs ...
4
votes
1answer
624 views

pam_tty_audit and non privileged users

I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file: session ...
-1
votes
1answer
318 views

linux automatic change permissions in resolv.file

In various linux servers I see how the permissions of the /etc/resolv.conf file change automatically. In state normal: -r--r--r-- 1 root root 103 Jul 4 11:50 resolv.conf In changed state: ...
1
vote
1answer
755 views

auditd rule for number of logins

I am using Debian squeeze and installed auditd on it. When I run aureport it always shows Number of logins = 0 and Number of failed logins = 0. What rule should be added in audit rules for recording ...
2
votes
2answers
625 views

Auditing changes to the audit log

I have configured auditd for PCI compliance reasons PCI states that existing logs cannot be changed without generating an alert This article ...
1
vote
1answer
237 views

Why can't I run ausearch (part of auditd) remotely over SSH?

Any idea why the following doesn't work? It hangs with no output. desktop$ ssh myserver "sudo ausearch -k my_key" However, the following works. It outputs the auditing history of this key from ...
9
votes
6answers
2k views

Files disappearing on linux server

I've got 4 specific files that seem to keep disappearing from a user's home directory. As far as we know, there are no cronjobs or other automated tasks that would be removing them. I've setup auditd ...
5
votes
1answer
1k views

Suggestion for auditd set-up

I am trying to learn about securing a Linux box (I am using Ubuntu). Auditd is recommended for monitoring activities on the node. I have managed to install it, but I can't find much information about ...
1
vote
2answers
2k views

problem of setting audit rules: Syscall name unknown: stime

I am setting audit rules in /etc/audit/audit.rules. As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions. So I add one line into ...
1
vote
1answer
323 views

How can I pick up vsftpd logins with auditd and its prelude plugin?

I have a server running auditd and prelude with the audisdp-prelude plugin. Currently I get events for several types of logins, like sshd and gdm. However I don't seem to ever get login info for ...
7
votes
4answers
7k views

File audit in Linux: how to watch directory tree for deletions?

I have a forum script running on server and somehow small number of attachments begin to get lost. I want to find out what is deleting them and at what time. How can I setup Linux auditd (auditctl) to ...