auditd is the userspace component to the Linux Auditing System.

learn more… | top users | synonyms

0
votes
0answers
13 views

How to record audit logs for only one specified file in FreeBSD?

On Red Hat Linux I can specify the file I want to record audit logs for with this command: auditctl -a exit,always -F path=/tmp/foo.txt -F perm=war I cannot figure out how to do a similar thing on ...
-1
votes
1answer
19 views

How to tell if auditd has suspended logging?

If you put the following in your auditd.conf, auditd will suspend logging when you have 50MB or less space on your disk: admin_space_left = 50 admin_space_left_action = SUSPEND How can an external ...
1
vote
0answers
44 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN ...
0
votes
0answers
8 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
1
vote
0answers
9 views

Audit only changes to files

I'm using Auditd to record any changes to files. Here is rule: # auditctl -l LIST_RULES: exit,always dir=/var/local/ (0x1e) perm=w key=state-files but if I run: # ausearch -i -k state-files ...
1
vote
1answer
101 views

How to enable syscall auditing in CoreOs?

Since CoreOs 766, the auditing subsystem is partially integrated: The audit subsystem has been enabled in the kernel and auditctl added to the image. Most audit events are ignored by default. ...
0
votes
0answers
22 views

Trying to find a trojan with Auditctl. Not enough information

So I have a website in Wordpress that keeps getting infected and starts sending spam emails. I have set up rules on AuditCTL on my Centos 6 server to find the culprit script but the information is ...
2
votes
2answers
115 views

How to log all commands run on Linux including their arguments (parameters)? [duplicate]

How can I log all commands executed on Linux, including their command-line arguments (parameters)? So, for example, if someone runs: rm -rf /tmp/foo I would see a log entry similar to this: ...
0
votes
0answers
18 views

auditd: Difference between watch and syscall

There appear to be two ways of specifying an auditd rule to watch a given file or folder. The first uses -a -a exit,always -F dir=/path/to/file -F perm=wa -F success=1 And the second uses -w -w ...
0
votes
1answer
31 views

After change, puppet now runs as the “ubuntu” user, and auditd is freaking out

This is a very strange question and I don't even know how to Google for it, so I'm posting here to see if anyone has encountered this sort of situation before. I have multiple Ubuntu 14.04 systems ...
1
vote
1answer
37 views

Access history for NFS server

I have a server (OS: Debian), in which nfs-kernel-server is installed and run. When a NFS client access or read, write to a file or directory in the NFS share directory, I want to capture and save all ...
0
votes
1answer
23 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
-1
votes
2answers
124 views

auditd: how to install from source in Ubuntu?

I want to setup auditd to collect its logs from remote server. I'm using Ubuntu 14.04.3 LTS. This feature seems to be disabled into Ubuntu auditd package. So, I'm going to install it from source. ...
0
votes
1answer
37 views

What is the correct way to generate /etc/audit/audit.rules on Centos7?

At the top of /etc/audit/audit.rules on Centos7 it tells me: ## This file is automatically generated from /etc/audit/rules.d Okay, so I went and looked, and found /etc/audit/rules.d/audit.rules. It ...
0
votes
1answer
62 views

Auditd multi-line log format

It seems that for any given "event" that auditd picks up, there are on the order of four log lines added to the auditd log. Is there any predictable pattern that can be used to group log file lines ...
0
votes
0answers
36 views

Audit ftp client connections

My purpose is to monitor file transfers from several Linux machines using only FTP client connections to a central FTP server. Files are produced in the clients and are regularly sent to the server. A ...
2
votes
1answer
86 views

How to log execution of a specific binary/script using auditd or other

I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as ...
1
vote
1answer
54 views

Auditd is writing a lot to logs

I recently tried to use auditd to find what's creating tmp files on a CentOS 5 x64 OS. I removed the rules: # auditctl -l No rules but there is a lot of writing into auditd logs. If I check the ...
2
votes
1answer
94 views

How to find out what what's creating temporary files

I notice a lot of empty files in /tmp with names similar to "/tmp/tmp.tMIHx17730". I run audit rule and I found out that mktemp is creating it which is not too helpful. How do I find out which script ...
0
votes
1answer
80 views

When does augenrules run automatically on CentOS 7.1?

I need to update /etc/audit/audit.rules. I would replace the file restart the service, but I found in the log a call to augenrules during initial startup of the machine. Apart from the initial ...
0
votes
0answers
30 views

Why is solaris auditing not working after adding new class entry

I have setup a new class entry in the audit_control, audit_class and audit_event files as below: $ grep pf /etc/security/audit_control flags:pf $ grep pf /etc/security/audit_event ...
1
vote
0answers
58 views

audisp-remote signal USR1 works as root, not with sudo

So I have a weird problem that I'm running out of ideas to troubleshoot. My RedHat machines are using audisp-remote to send syslog messages to a central server. audisp-remote will respond to the ...
0
votes
0answers
12 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
0
votes
1answer
46 views

How do audit changes to dir via symlink?

Use of the auditd system to watch a directory via a symlink hardly triggers any logs. Here is the situation: # pwd /home/root/serverfault # ls -l total 4 drwxr-xr-x 2 root root 4096 Sep 1 15:12 ...
9
votes
2answers
311 views

Is there a way to know why a service is restarted and who did it?

Ubuntu 14.04 clamav 0.98.7 The problem is clamav-daemon is restarted nearly daily: Sep 1 06:30:00 x-master clamd[6778]: Pid file removed. clamd[6778]: --- Stopped at Tue Sep 1 06:30:00 2015 ...
2
votes
0answers
90 views

Why does ausearch skip entries?

I am trying to use the ausearch tool search my auditd logs for specific entries. The problem is that most of the entries in audit.log appear to be unsearchable. Searching with matching parameters ...
0
votes
0answers
61 views

How to monitor keystrokes of an lxc guest that is connected via ssh?

I have an unprivileged LXC container which runs an SSH server (both LXC guest and LXC host are Ubuntu 14 servers) . The ports to connect to the container are forwarded, so one can connect from outside ...
0
votes
1answer
375 views

auditctl buffer setting - how large is this?

Within the default audit.rules file on CentOS 5, 6 and 7, the following is set: # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 However, there is no ...
3
votes
1answer
394 views

Auditing in linux

I am trying to setup a robust auditing mechanism on my centos 6.x boxes. I tried and tested various auditing tools like auditd aide psacct But none is full filling my requirement. My requirement ...
1
vote
0answers
89 views

Why is audispd dropping events? What is in the queue?

My audispd keeps logging lots of queue full errors. Jun 9 08:46:29 web audispd: queue is full - dropping event I'd like to understand better why the queue is filling up and whether there is a ...
0
votes
1answer
637 views

auditd process stops logging after logrotate script runs

I am trying to use logrotate to keep audit logs for a set period of time rather than using auditd's special rotation (from /etc/audit/auditd.conf). I have changed the max_log_file_action to IGNORE in ...
0
votes
0answers
128 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...
0
votes
0answers
304 views

Samba module full_audit is logging actions that didn't occured

Our company has a file server, a Debian Squeeze 64 bits, sharing some folders to Linux servers using NFSv2 and to Windows workstations using Samba. I want to log access to a specific set of shared ...
0
votes
0answers
66 views

Folder keeps getting deleted and I can't find out why

I have a Joomla based website running on CentOS, Apache, PHP, MySQL. I am using plupload file uploader to upload the files. I'm uploading the files to /tmp/uploads directory where they are processed ...
1
vote
2answers
549 views

auditd execve arguments that looks like encoded data

I'm logging all execve's in a sort of honey pot box and as such I try to make sense of the commands. There's many many of these, all with 'bash -c' and some long alpha numerical value not enclosed in ...
1
vote
1answer
729 views

How to find out PID of the process sending packets (generating network traffic)?

Couple of weeks ago I had an issue where I changed DNS addresses in large network of around 300 nodes. After that, some of the nodes still continued to ask old DNS servers, although resolv.conf was ...
4
votes
2answers
3k views

Centos 6.5 auditd fails to start with service or /etc/init.d/audit start

Fail: # service auditd start Starting auditd: [FAILED] Fail: # /etc/init.d/auditd start Starting auditd: ...
0
votes
1answer
82 views

Logging SFTP activity with auditd

I am currently using auditd to log TTY activity for users that are SSH'd into my system. However, SFTP sessions are not logged in this way. Is there a way to log them using auditd or will I need to ...
0
votes
1answer
109 views

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset ...
1
vote
1answer
170 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
0
votes
3answers
424 views

Track any file changes using auditd

I try configure PCI REQ 10.5.5 "Use file integrity monitoring or change detection software on logs" Use auditd for this, rule "auditctl -w /tmp/testfile -p war" works perfectly. But if I try to use ...
0
votes
0answers
3k views

Disable auditd immutable mode without rebooting

Hello I've been tasked with fixing up a auditd policy but it's on a server that's actively being used and the policy installed was set immutable. I've tried searching and everyone recommends rebooting ...
1
vote
1answer
55 views

How to properly look for an info about auditd being turned off from init?

I have a mystery on my hands. One day /etc/rc5.d/S11auditd became /etc/rc5.d/K88auditd and no one takes responsibility for it. It looks like it just happened by itself, which is hardly plausible and ...
1
vote
1answer
655 views

Ignore specific types with auditd

I've recently been playing around with auditd and trying to cut out some of what it is logging. Here is my audit.rules entry to log execve # First rule - delete all -D -a always,exit -F arch=b64 -S ...
2
votes
1answer
676 views

log bash command centralized server or any auditd saas [duplicate]

I'm looking for a way to track our sysmin work, in the servers. Lets say sysmin 1 and sysmin 2 have access to any server but we need to make sure and track anything that they do in our server. ...
1
vote
0answers
126 views

How can I get auditd on RHEL6 to dispatch forwarded messages?

Using RHEL6, I currently have audispd setup to send logs to a remote server. The remote server successfully receives the messages, and writes them to the remote audit log. My problem is, I can't seem ...
0
votes
1answer
125 views

Logging violations of rules in limits.conf

I am trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
2
votes
1answer
5k views

How to install auditd on CentOS?

How to install auditd on CentOS 6.4 x64 ? I want to Log all commands run by admins Log all commands run by admins on production servers Edit: I can't run aduditd service I did with this tut enter ...
1
vote
1answer
110 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
1
vote
1answer
1k views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...