auditd is the userspace component to the Linux Auditing System.

learn more… | top users | synonyms

-1
votes
2answers
26 views

auditd: how to install from source in Ubuntu?

I want to setup auditd to collect its logs from remote server. I'm using Ubuntu 14.04.3 LTS. This feature seems to be disabled into Ubuntu auditd package. So, I'm going to install it from source. ...
0
votes
0answers
12 views

What is the correct way to generate /etc/audit/audit.rules on Centos7?

At the top of /etc/audit/audit.rules on Centos7 it tells me: ## This file is automatically generated from /etc/audit/rules.d Okay, so I went and looked, and found /etc/audit/rules.d/audit.rules. It ...
0
votes
0answers
12 views

Auditd multi-line log format

It seems that for any given "event" that auditd picks up, there are on the order of four log lines added to the auditd log. Is there any predictable pattern that can be used to group log file lines ...
0
votes
0answers
22 views

Audit ftp client connections

My purpose is to monitor file transfers from several Linux machines using only FTP client connections to a central FTP server. Files are produced in the clients and are regularly sent to the server. A ...
2
votes
1answer
66 views

How to log execution of a specific binary/script using auditd or other

I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as ...
0
votes
1answer
31 views

Auditd is writing a lot to logs

I recently tried to use auditd to find what's creating tmp files on a CentOS 5 x64 OS. I removed the rules: # auditctl -l No rules but there is a lot of writing into auditd logs. If I check the ...
2
votes
1answer
58 views

How to find out what what's creating temporary files

I notice a lot of empty files in /tmp with names similar to "/tmp/tmp.tMIHx17730". I run audit rule and I found out that mktemp is creating it which is not too helpful. How do I find out which script ...
0
votes
1answer
36 views

When does augenrules run automatically on CentOS 7.1?

I need to update /etc/audit/audit.rules. I would replace the file restart the service, but I found in the log a call to augenrules during initial startup of the machine. Apart from the initial ...
0
votes
0answers
25 views

Why is solaris auditing not working after adding new class entry

I have setup a new class entry in the audit_control, audit_class and audit_event files as below: $ grep pf /etc/security/audit_control flags:pf $ grep pf /etc/security/audit_event ...
1
vote
0answers
46 views

audisp-remote signal USR1 works as root, not with sudo

So I have a weird problem that I'm running out of ideas to troubleshoot. My RedHat machines are using audisp-remote to send syslog messages to a central server. audisp-remote will respond to the ...
0
votes
0answers
8 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
0
votes
1answer
32 views

How do audit changes to dir via symlink?

Use of the auditd system to watch a directory via a symlink hardly triggers any logs. Here is the situation: # pwd /home/root/serverfault # ls -l total 4 drwxr-xr-x 2 root root 4096 Sep 1 15:12 ...
9
votes
2answers
285 views

Is there a way to know why a service is restarted and who did it?

Ubuntu 14.04 clamav 0.98.7 The problem is clamav-daemon is restarted nearly daily: Sep 1 06:30:00 x-master clamd[6778]: Pid file removed. clamd[6778]: --- Stopped at Tue Sep 1 06:30:00 2015 ...
1
vote
0answers
53 views

Why does ausearch skip entries?

I am trying to use the ausearch tool search my auditd logs for specific entries. The problem is that most of the entries in audit.log appear to be unsearchable. Searching with matching parameters ...
0
votes
0answers
51 views

How to monitor keystrokes of an lxc guest that is connected via ssh?

I have an unprivileged LXC container which runs an SSH server (both LXC guest and LXC host are Ubuntu 14 servers) . The ports to connect to the container are forwarded, so one can connect from outside ...
0
votes
1answer
233 views

auditctl buffer setting - how large is this?

Within the default audit.rules file on CentOS 5, 6 and 7, the following is set: # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 However, there is no ...
1
vote
0answers
223 views

Auditing in linux

I am trying to setup a robust auditing mechanism on my centos 6.x boxes. I tried and tested various auditing tools like auditd aide psacct But none is full filling my requirement. My requirement ...
1
vote
0answers
65 views

Why is audispd dropping events? What is in the queue?

My audispd keeps logging lots of queue full errors. Jun 9 08:46:29 web audispd: queue is full - dropping event I'd like to understand better why the queue is filling up and whether there is a ...
0
votes
1answer
377 views

auditd process stops logging after logrotate script runs

I am trying to use logrotate to keep audit logs for a set period of time rather than using auditd's special rotation (from /etc/audit/auditd.conf). I have changed the max_log_file_action to IGNORE in ...
0
votes
0answers
97 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...
0
votes
0answers
208 views

Samba module full_audit is logging actions that didn't occured

Our company has a file server, a Debian Squeeze 64 bits, sharing some folders to Linux servers using NFSv2 and to Windows workstations using Samba. I want to log access to a specific set of shared ...
0
votes
0answers
51 views

Folder keeps getting deleted and I can't find out why

I have a Joomla based website running on CentOS, Apache, PHP, MySQL. I am using plupload file uploader to upload the files. I'm uploading the files to /tmp/uploads directory where they are processed ...
0
votes
0answers
147 views

How do I get auditd to push messages to a remote syslog server on Centos 6.6?

I'm a Windows guy trying to help a friend out. We need to get file auditing data off the Centos 6.6 server to a central syslog server. I found the auditd service and the audisp plugin. I edited the ...
1
vote
2answers
403 views

auditd execve arguments that looks like encoded data

I'm logging all execve's in a sort of honey pot box and as such I try to make sense of the commands. There's many many of these, all with 'bash -c' and some long alpha numerical value not enclosed in ...
1
vote
1answer
518 views

How to find out PID of the process sending packets (generating network traffic)?

Couple of weeks ago I had an issue where I changed DNS addresses in large network of around 300 nodes. After that, some of the nodes still continued to ask old DNS servers, although resolv.conf was ...
4
votes
2answers
3k views

Centos 6.5 auditd fails to start with service or /etc/init.d/audit start

Fail: # service auditd start Starting auditd: [FAILED] Fail: # /etc/init.d/auditd start Starting auditd: ...
0
votes
1answer
70 views

Logging SFTP activity with auditd

I am currently using auditd to log TTY activity for users that are SSH'd into my system. However, SFTP sessions are not logged in this way. Is there a way to log them using auditd or will I need to ...
0
votes
1answer
98 views

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset ...
1
vote
1answer
145 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
0
votes
3answers
340 views

Track any file changes using auditd

I try configure PCI REQ 10.5.5 "Use file integrity monitoring or change detection software on logs" Use auditd for this, rule "auditctl -w /tmp/testfile -p war" works perfectly. But if I try to use ...
0
votes
0answers
2k views

Disable auditd immutable mode without rebooting

Hello I've been tasked with fixing up a auditd policy but it's on a server that's actively being used and the policy installed was set immutable. I've tried searching and everyone recommends rebooting ...
1
vote
1answer
53 views

How to properly look for an info about auditd being turned off from init?

I have a mystery on my hands. One day /etc/rc5.d/S11auditd became /etc/rc5.d/K88auditd and no one takes responsibility for it. It looks like it just happened by itself, which is hardly plausible and ...
1
vote
1answer
493 views

Ignore specific types with auditd

I've recently been playing around with auditd and trying to cut out some of what it is logging. Here is my audit.rules entry to log execve # First rule - delete all -D -a always,exit -F arch=b64 -S ...
2
votes
1answer
581 views

log bash command centralized server or any auditd saas [duplicate]

I'm looking for a way to track our sysmin work, in the servers. Lets say sysmin 1 and sysmin 2 have access to any server but we need to make sure and track anything that they do in our server. ...
1
vote
0answers
114 views

How can I get auditd on RHEL6 to dispatch forwarded messages?

Using RHEL6, I currently have audispd setup to send logs to a remote server. The remote server successfully receives the messages, and writes them to the remote audit log. My problem is, I can't seem ...
0
votes
1answer
112 views

Logging violations of rules in limits.conf

I am trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
2
votes
1answer
4k views

How to install auditd on CentOS?

How to install auditd on CentOS 6.4 x64 ? I want to Log all commands run by admins Log all commands run by admins on production servers Edit: I can't run aduditd service I did with this tut enter ...
1
vote
1answer
107 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
1
vote
1answer
955 views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...
2
votes
1answer
89 views

Sudden new S11auditd in /etc/rc3.d

We have several machines running under Fedora 12. We have to deal with complete reinstallation quite often as our product comes with the whole distibution. I've noticed that sometimes soon after new ...
2
votes
1answer
573 views

Using auditd to watch a directory non-recursively?

I'm working on a Cent 6 Cpanel machine, and some mystery script is changing the permissions of home directories (!) to 777. I've ruled out all the easy fixes, so I just need to set up a watch on the ...
4
votes
2answers
985 views

Getting auditd to record the original user

This question is related to my previous question: Log all commands run by admins on production servers It is company policy for admins to login to the servers via a personal username, and then run ...
0
votes
1answer
650 views

How to check which processes are deleting files without using inotify or auditd? [closed]

I'm trying to figure out which processes are deleting files from a specific directory on my CentOS server. I looked at inotify, but all this does is to tell me how many file deletions are occurring; ...
2
votes
2answers
485 views

How to figure out which processes are deleting files from a specific directory?

I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system. I've set up the following rule in audit.rules: -w S unlink -S ...
2
votes
0answers
181 views

difference between success and failed event in auditd/aureport

The aureport command has two options that limit the list of displayed events to those that were successful and those that failed. Per the man page: --failed Only select failed events ...
1
vote
0answers
243 views

Unexpected jBoss crash and auditing signals

We're experiencing unexpected JBoss crashes on a semi-regular basis. JBoss 5 is running on RHEL6 in this case. I believe this is related to a sigusr1 sent to the JBoss process. The JBoss server logs ...
4
votes
1answer
713 views

pam_tty_audit and non privileged users

I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file: session ...
-1
votes
1answer
346 views

linux automatic change permissions in resolv.file

In various linux servers I see how the permissions of the /etc/resolv.conf file change automatically. In state normal: -r--r--r-- 1 root root 103 Jul 4 11:50 resolv.conf In changed state: ...
1
vote
1answer
860 views

auditd rule for number of logins

I am using Debian squeeze and installed auditd on it. When I run aureport it always shows Number of logins = 0 and Number of failed logins = 0. What rule should be added in audit rules for recording ...
2
votes
2answers
781 views

Auditing changes to the audit log

I have configured auditd for PCI compliance reasons PCI states that existing logs cannot be changed without generating an alert This article ...