Questions tagged [auditd]
auditd is the userspace component to the Linux Auditing System.
163
questions
0
votes
0
answers
16
views
Auditd log format ENRICHED and syslog-ng
I want to send audit data to a syslog trap using syslog-ng.
It works, but since I set the log_format option to enriched in auditd.conf the log in the /var/log/audit/auditd.log contains both enriched ...
- 101
0
votes
0
answers
80
views
How to identify which process made dns query for a particular host?
I can get logs for dns query made to a particular nameserver by auditd, but how can I get process which made dns query for a host.
- 203
0
votes
3
answers
4k
views
Track any file changes using auditd
I try configure PCI REQ 10.5.5
"Use file integrity monitoring or change detection software on logs"
Use auditd for this,
rule auditctl -w /tmp/testfile -p war works perfectly.
But if I try ...
- 119
0
votes
1
answer
3k
views
Linux Auditd: Error receiving audit netlink packet (No buffer space available)
I have some Linux servers that are getting errors like the below in the logs...
auditd[1074]: Error receiving audit netlink packet (No buffer space available)
I know HOW to resolve the issue (tweak ...
0
votes
0
answers
216
views
SELinux silently blocking PHP process listing
I have a system where we use PHP to run some rudimentary health checks on the server. When hitting a status page, it verifies that certain processes are running, and returns an error message if ...
- 383
1
vote
0
answers
197
views
How to set proctitle to ascii in auditd?
I configured auditd to send the logs to SIEM through rsyslog.
But when I get those logs the proctitle is in hex.
Ex.:
<134>Aug 25 17:08:44 vmauditd tag_audit_log: node=vmauditd type=PROCTITLE ...
- 111
1
vote
1
answer
376
views
Audit log emails not going to the correct address
On Ubuntu 20, I'm trying to send audit logs to [email protected]. I do have a real domain and email server but I'm redacting them here. When I trigger an audit event, the email is instead sent ...
1
vote
1
answer
113
views
auditd.conf - when is "verify_email" actually checked?
When using an email address in /etc/audit/auditd.conf, there is an option verify_email which is defined as,
This option determines if the email address given in action_mail_acct is checked to see if ...
- 49.8k
1
vote
1
answer
599
views
Find process that makes outbound HTTP calls, trying auditd with syslog-ng
Some of application (it's unknown) makes sporadic nonregular rare short outbound HTTP(S) requests to a known host/port/url (this is a WAF honeypot, host/url/port is known) using HTTPS protocol.
...
- 146
0
votes
1
answer
1k
views
Restart of auditd causes audispd reconfigure infinite loop
We restart some of our services on Debian jessie every night at 11:45 PM as part of logfile rotation. Among those services that we restart is the auditd service. We are sometimes seeing that audispd ...
1
vote
1
answer
861
views
Auditd not sending to remote central server
I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server.
Note: instead of going to /etc/audisp/, these
...
1
vote
1
answer
3k
views
Auditd is writing a lot to logs
I recently tried to use auditd to find what's creating tmp files on a CentOS 5 x64 OS. I removed the rules:
# auditctl -l
No rules
but there is a lot of writing into auditd logs. If I check the logs ...
- 141
5
votes
1
answer
1k
views
pam_tty_audit and non privileged users
I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file:
session ...
- 141
1
vote
1
answer
1k
views
Record ssh REMOTE_USER in audit or history logs
In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys.
Now, quite a few people work on those servers and sometimes we need to ...
- 141
1
vote
2
answers
674
views
What can you do when auditd halts the system?
I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again ...
- 111
0
votes
0
answers
138
views
How to configure osquery with auditd
Who has expertise on how to work with osquery (or maybe you solved this problem):
Based on articles like this one - https://blog.palantir.com/auditing-with-osquery-part-two-configuration-and-...
1
vote
1
answer
148
views
Auditd - Don't log events from salt-minion
I'm updating our Auditd rules (Red Hat Linux) to log all tty/interactive commands from all users. That part works no problem.
What I'm trying to do now is to exclude commands issued by our salt-...
- 185
16
votes
6
answers
9k
views
Files disappearing on linux server
I've got 4 specific files that seem to keep disappearing from a user's home directory. As far as we know, there are no cronjobs or other automated tasks that would be removing them. I've setup auditd ...
- 18.4k
0
votes
1
answer
208
views
Losing Audit Logs When Tracing a Container
As you know, Linux Audit is not installed on Ubuntu Focal by default. I installed it, and my goal is to trace what containers do. I have this seccomp profile:
{
"defaultAction": &...
0
votes
1
answer
190
views
Audit Log Partition keeps getting corrupted. How to prevent or boot anyway?
I am running RHEL7, and my audit log partition randomly (not often, but often enough to annoy me) gets corrupted, preventing me from booting. How can I either prevent the partition from being ...
- 161
1
vote
1
answer
2k
views
auditd auid changes after su
I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers
If I ...
CommunityBot
- 1
0
votes
2
answers
872
views
selinux audit rule not logging anything
I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
- 1
0
votes
0
answers
93
views
Why Firefox is trying to access .bashrc?
This Ubuntu 22.04 installation is fairly new. Why firefox is trying to read .bashrc and many other files. Does this indicate a security breach?
[340664.822484] audit: type=1400 audit(1665738538.467:...
1
vote
0
answers
137
views
Linux Auditd monitoring of file operations in mounted folder
I have multi node kubernetes cluster and I would like to monitor file operations that are made by containers in mounted persistent volume.
I found the all PV data are located at nodes in /var/lib/...
- 11
1
vote
0
answers
554
views
auditd - dir cannot be used with exclude filter?
I have a problem with auditd rules. I'd like to audit /opt/zimbra/mailboxd/webapps/ dir but without: zimbraAdmin/WEB-INF/,zimlet/WEB-INF/ and zimbra/WEB-INF/ subfolders.
cat /etc/audit/audit.rules:
## ...
- 241
2
votes
2
answers
19k
views
Problems with auditd rules files
I have a problem generating auditd rules on CentOS 7.
I have 2 .rules files in my /etc/audit/rules.d/ directory. Both files are owned by root and only root has access. When I reload the rules using ...
- 101
1
vote
1
answer
2k
views
auditd - Getting only EXECVE in ausearch?
I'd like to use the auditd daemon to log whatever is run as or by root on our servers. To that effect, I added the following lines to /etc/audit/audit.rules:
# Log all commands run as (or by) root
-a ...
CommunityBot
- 1
0
votes
1
answer
4k
views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
CommunityBot
- 1
1
vote
3
answers
4k
views
problem of setting audit rules: Syscall name unknown: stime
I am setting audit rules in /etc/audit/audit.rules.
As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.
So I add one line into /...
- 101
1
vote
1
answer
5k
views
Redirect Auditd.log data to rsyslog in RHEL-7
I would like to redirect the auditd log data into rsyslog instead of audit.log file.
I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to
...
- 317
0
votes
1
answer
1k
views
CIS compliant auditd configuration on Red Hat 7/8
We have a large fleet of Red Hat 7/8 systems. We have a requirement to make sure that all systems are CIS compliant.
One of the requirement is to not automatically rotate the audit logs. That is, ...
- 33.3k
1
vote
0
answers
203
views
auditd killing a server?
In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"):
...
audit: audit_backlog=32769 > audit_backlog_limit=...
- 51
1
vote
0
answers
976
views
stop kernel audit messages logged in syslog without disabling auditing
OS: CentOS 7
I am trying to figure out how audit (kaudit) events are logged in /var/log/messages.
I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
- 1,824
1
vote
1
answer
461
views
Auditd not sending logs to centralized auditd log server
We have set up centralized logging of auditd messages for two machines:
machine (www22.domain.com) is the source (centos8)
machine (cls.domain.com) is the centralized log server (centos7)
This was ...
- 282
3
votes
1
answer
3k
views
Sending auditd records to my audispd plugin
After setting auditctl's rules, I want to send those matched records to my Python script for further analysis.
These are the involved files:
auditd records:
type=PATH msg=audit(1451011319.268:533): ...
CommunityBot
- 1
1
vote
1
answer
137
views
auditctl doesn't stores reads
So I have this rule on auditctl:
-w /home/ec2-user/myfile -p rwa -k key-name
But when I run
ausearch -f /home/ec2-user/myfile
or check the logs in /var/log/audit/audit.log, I can't see any ...
- 3,928
2
votes
1
answer
3k
views
CentOS doesn't boot with "A stop job is running for Security Auditing Service" message
CentOS prints the following during boot
[ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s)
and then switches into the single user mode.
- 193
1
vote
1
answer
439
views
Log execve's, along with parent process argv?
I'm trying to figure out if I can decomission an old server. I need the information about automated processes running there. So far I tried the following:
auditctl -a exit,always -F arch=b64 -S ...
- 3,357
1
vote
0
answers
207
views
selinux - why can't stuff_u with sysadm_r run postsuper?
I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand.
According to redhat
SELinux User Capabilities
stuff_u users should be ...
- 21
1
vote
0
answers
241
views
Monitoring IPv6 connection via auditd
some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection
I'have found helpful article about that - Finding short-lived TCP ...
- 11
0
votes
1
answer
860
views
How to install `aide` without `aide-common` in debian?
Per this post,
Newer versions of Ubuntu (including 14.04) come with two packages for
AIDE:
aide, with the aide command and manual page, and little else
aide-common, with a wrapper around that ...
- 9,294
0
votes
1
answer
605
views
how send alert message from script to auditd.log?
Due to auditing policies ( auditd.log is monitored), I have to send alert messages from my adhoc check scripts to auditd.log.
Any idea what is best / standard solution ?
I think that echo log >>...
- 444
6
votes
1
answer
15k
views
What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?
My server is centos7.6 with auditd 2.8.5
In audit rule, I set:
-a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change
But this rule also record normal ntpd activities,then I tried ...
- 113
1
vote
2
answers
263
views
Issue with running Linux Audit System in a nested Virtual Machine inside Google Cloud Engine
I am trying to run the Linux audit system in a nested Virtual machine on the google cloud engine. The problem I am facing is that the Linux Audit System suspends after showing the following error ...
google-cloud-platform
1
vote
0
answers
199
views
CentOS USER_CMD logs auditd
We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it?
We already getting commands, starting with sudo, but not ...
- 8,936
3
votes
1
answer
6k
views
How to log execution of a specific binary/script using auditd or other
I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as ...
CommunityBot
- 1
1
vote
0
answers
260
views
Auditd to CloudwatchLogs to IDS alerts?
I'm administering a relatively simple AWS stack with about 5 heterogeneous Linux EC2 instances. All instances already have been setup to ship important logs to Cloudwatch Logs. Now I want to setup a ...
- 207
1
vote
0
answers
312
views
Tracking TCP Connection in background
I am looking for a daemon utility to track all non local TCP connections and which binaries establish the TCP connections (actively and passively) with which IPs and ports.
auditd seems like a great ...
- 255
3
votes
2
answers
1k
views
Why can't I run ausearch (part of auditd) remotely over SSH?
Any idea why the following doesn't work? It hangs with no output.
desktop$ ssh myserver "sudo ausearch -k my_key"
However, the following works. It outputs the auditing history of this key from ...
- 11
0
votes
2
answers
2k
views
Disable cron messages in auditd
I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS.
For example, even if my /etc/audit/audit.rules contains no rules:
-...
- 11