Questions tagged [auditd]
auditd is the userspace component to the Linux Auditing System.
163
questions
16
votes
6
answers
9k
views
Files disappearing on linux server
I've got 4 specific files that seem to keep disappearing from a user's home directory. As far as we know, there are no cronjobs or other automated tasks that would be removing them. I've setup auditd ...
- 1,540
11
votes
6
answers
46k
views
How to find out PID of the process sending packets (generating network traffic)?
Couple of weeks ago I had an issue where I changed DNS addresses in large network of around 300 nodes. After that, some of the nodes still continued to ask old DNS servers, although resolv.conf was ok,...
- 5,287
10
votes
2
answers
955
views
Is there a way to know why a service is restarted and who did it?
Ubuntu 14.04
clamav 0.98.7
The problem is clamav-daemon is restarted nearly daily:
Sep 1 06:30:00 x-master clamd[6778]: Pid file removed.
clamd[6778]: --- Stopped at Tue Sep 1 06:30:00 2015
clamd[...
- 51.8k
9
votes
4
answers
14k
views
File audit in Linux: how to watch directory tree for deletions?
I have a forum script running on server and somehow small number of attachments begin to get lost. I want to find out what is deleting them and at what time. How can I setup Linux auditd (auditctl) to ...
- 2,691
7
votes
2
answers
10k
views
auditd execve arguments that looks like encoded data
I'm logging all execve's in a sort of honey pot box and as such I try to make sense of the commands. There's many many of these, all with 'bash -c' and some long alpha numerical value not enclosed in ...
- 4,350
6
votes
2
answers
32k
views
What is the correct way to generate /etc/audit/audit.rules on Centos7?
At the top of /etc/audit/audit.rules on Centos7 it tells me:
## This file is automatically generated from /etc/audit/rules.d
Okay, so I went and looked, and found /etc/audit/rules.d/audit.rules. It ...
- 739
6
votes
2
answers
8k
views
What does auditd log by default (i.e. when no rules are defined?)
I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example:
type=LOGIN msg=audit(...
- 325
6
votes
3
answers
14k
views
Centos 6.5 auditd fails to start with service or /etc/init.d/audit start
Fail:
# service auditd start
Starting auditd: [FAILED]
Fail:
# /etc/init.d/auditd start
Starting auditd: [FAILED]...
- 376
6
votes
1
answer
1k
views
Suggestion for auditd set-up
I am trying to learn about securing a Linux box (I am using Ubuntu). Auditd is recommended for monitoring activities on the node. I have managed to install it, but I can't find much information about ...
- 4,787
6
votes
1
answer
5k
views
How to find out what what's creating temporary files
I notice a lot of empty files in /tmp with names similar to "/tmp/tmp.tMIHx17730". I run audit rule and I found out that mktemp is creating it which is not too helpful.
How do I find out which script ...
- 288
6
votes
1
answer
15k
views
What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?
My server is centos7.6 with auditd 2.8.5
In audit rule, I set:
-a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change
But this rule also record normal ntpd activities,then I tried ...
- 975
5
votes
2
answers
6k
views
Getting auditd to record the original user
This question is related to my previous question: Log all commands run by admins on production servers
It is company policy for admins to login to the servers via a personal username, and then run ...
- 4,376
5
votes
1
answer
7k
views
auditctl buffer setting - how large is this?
Within the default audit.rules file on CentOS 5, 6 and 7, the following is set:
# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320
However, there is no ...
- 173
5
votes
1
answer
1k
views
pam_tty_audit and non privileged users
I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file:
session ...
- 51
4
votes
1
answer
4k
views
View auditd logs in journalctl
I'm using CentOS 7. trying to view auditd logs in journalctl
When I try journalctl -u auditd I see the following output:
-- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 ...
- 3,206
4
votes
1
answer
4k
views
suppress audit events from a specific user
I'm trying to track down the source cause of a breakin on a serverhosting customer's website.
auditd is a great help in showing me what directory to look in when yet another bit of malware (the site ...
- 1,367
4
votes
2
answers
3k
views
Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)
My auditd rules and my needs are fairly simple, I want only to log root actions.
# auditctl -l
-a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION
That is the only rule, and it works:
type=...
- 265
4
votes
1
answer
2k
views
Auditing in linux
I am trying to setup a robust auditing mechanism on my centos 6.x boxes. I tried and tested various auditing tools like
auditd
aide
psacct
But none is full filling my requirement. My requirement ...
- 171
4
votes
2
answers
6k
views
How to log all commands run on Linux including their arguments (parameters)? [duplicate]
How can I log all commands executed on Linux, including their command-line arguments (parameters)?
So, for example, if someone runs:
rm -rf /tmp/foo
I would see a log entry similar to this:
2016-...
- 2,499
4
votes
0
answers
2k
views
Why does ausearch skip entries?
I am trying to use the ausearch tool search my auditd logs for specific entries.
The problem is that most of the entries in audit.log appear to be unsearchable. Searching with matching parameters ...
- 171
3
votes
2
answers
1k
views
Why can't I run ausearch (part of auditd) remotely over SSH?
Any idea why the following doesn't work? It hangs with no output.
desktop$ ssh myserver "sudo ausearch -k my_key"
However, the following works. It outputs the auditing history of this key from ...
- 255
3
votes
3
answers
19k
views
What is the syslog facility for auditd logs?
Trying to forward only my auditd events by syslog, but I don't know which facility to use. I don't want to send everything to my syslog server as it would create redundancy in logging. I've set the ...
- 41
3
votes
1
answer
16k
views
Disable auditd immutable mode without rebooting
Hello I've been tasked with fixing up a auditd policy but it's on a server that's actively being used and the policy installed was set immutable. I've tried searching and everyone recommends rebooting ...
- 31
3
votes
1
answer
6k
views
How to log execution of a specific binary/script using auditd or other
I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as ...
- 131
3
votes
1
answer
13k
views
How to install auditd on CentOS?
How to install auditd on CentOS 6.4 x64 ?
I want to Log all commands run by admins
Log all commands run by admins on production servers
Edit: I can't run aduditd service
I did with this tut
enter ...
- 37
3
votes
1
answer
1k
views
Using auditd to watch a directory non-recursively?
I'm working on a Cent 6 Cpanel machine, and some mystery script is changing the permissions of home directories (!) to 777. I've ruled out all the easy fixes, so I just need to set up a watch on the ...
- 158
3
votes
1
answer
3k
views
Sending auditd records to my audispd plugin
After setting auditctl's rules, I want to send those matched records to my Python script for further analysis.
These are the involved files:
auditd records:
type=PATH msg=audit(1451011319.268:533): ...
- 141
3
votes
2
answers
688
views
How to figure out which processes are deleting files from a specific directory?
I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system.
I've set up the following rule in audit.rules:
-w S unlink -S ...
- 334
2
votes
1
answer
3k
views
Name rotated auditd logs with date
Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have
audit.log
audit.log.1
audit.log.2
...
When audit.log fills up all of the files are rotated one number ...
- 1,093
2
votes
1
answer
2k
views
How to enable syscall auditing in CoreOs?
Since CoreOs 766, the auditing subsystem is partially integrated:
The audit subsystem has been enabled in the kernel and auditctl added
to the image. Most audit events are ignored by default. The ...
- 83
2
votes
2
answers
4k
views
How to determine process which makes DNS Request? [duplicate]
I have a server on AWS, GuardDuty started send me notifications:
*** "type":"Backdoor:EC2/C&CActivity.B!DNS",
*** {"domain":"libcurl.so","protocol":"UDP","blocked":false}
*** is querying a domain ...
- 255
2
votes
2
answers
3k
views
What's stopping auditd from logging writes by Syslog when watching a Syslog file?
We've recently started using auditd on one of our Ubuntu servers.
The example audit.rules file we were given has a rule like this:
-w /var/log/syslog -p wra -k logs
However, when syslog writes to ...
- 81
2
votes
3
answers
936
views
Password change audit on solaris
Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts?
I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
- 123
2
votes
2
answers
5k
views
How to tell if auditd has suspended logging?
If you put the following in your auditd.conf, auditd will suspend logging when you have 50MB or less space on your disk:
admin_space_left = 50
admin_space_left_action = SUSPEND
How can an external ...
- 325
2
votes
2
answers
1k
views
Auditing changes to the audit log
I have configured auditd for PCI compliance reasons
PCI states that existing logs cannot be changed without generating an alert
This article http://ptresearch.blogspot.com/2010/11/requirement-10-...
- 55
2
votes
1
answer
3k
views
CentOS doesn't boot with "A stop job is running for Security Auditing Service" message
CentOS prints the following during boot
[ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s)
and then switches into the single user mode.
- 193
2
votes
2
answers
19k
views
Problems with auditd rules files
I have a problem generating auditd rules on CentOS 7.
I have 2 .rules files in my /etc/audit/rules.d/ directory. Both files are owned by root and only root has access. When I reload the rules using ...
- 21
2
votes
2
answers
4k
views
auditd process stops logging after logrotate script runs
I am trying to use logrotate to keep audit logs for a set period of time rather than using auditd's special rotation (from /etc/audit/auditd.conf). I have changed the max_log_file_action to IGNORE in ...
- 21
2
votes
1
answer
9k
views
Why is audispd dropping events? What is in the queue?
My audispd keeps logging lots of queue full errors.
Jun 9 08:46:29 web audispd: queue is full - dropping event
I'd like to understand better why the queue is filling up and whether there is a ...
- 313
2
votes
1
answer
121
views
Sudden new S11auditd in /etc/rc3.d
We have several machines running under Fedora 12. We have to deal with complete reinstallation quite often as our product comes with the whole distibution. I've noticed that sometimes soon after new ...
- 553
2
votes
0
answers
2k
views
Auditd how to exclude everything
I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant.
-a never,exclude -F msgtype=CWD
-a ...
- 41
2
votes
0
answers
1k
views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
- 397
2
votes
0
answers
329
views
How do I audit cgroup changes
I have a container process that is mysteriously changing cgroups long after it has been started. How do I track down who/what is changing it? I tried watching my audit log when manually doing a ...
- 121
2
votes
0
answers
1k
views
Linux Auditd tracking writes on external media
So I've been looking at ways to audit when a form of external media performs writes/ uploads on a Linux system. Currently the main solution I have come across is to simply audit when the mount and ...
- 21
2
votes
1
answer
2k
views
log bash command centralized server or any auditd saas [duplicate]
I'm looking for a way to track our sysmin work, in the servers.
Lets say sysmin 1 and sysmin 2 have access to any server but we need to make sure and track anything that they do in our server.
...
- 173
2
votes
1
answer
1k
views
difference between success and failed event in auditd/aureport
The aureport command has two options that limit the list of displayed events to those that were successful and those that failed. Per the man page:
--failed
Only select failed events ...
1
vote
1
answer
1k
views
Record ssh REMOTE_USER in audit or history logs
In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys.
Now, quite a few people work on those servers and sometimes we need to ...
- 143
1
vote
1
answer
832
views
Why does auditd only log `echo` when I use the absolute path?
Info
Running auditd version 2.6.5 on Centos 7.
My rules file contains:
-a exit,always -F arch=b64 -F auid=0 -S execve -k root_action
-a exit,always -F arch=b32 -F auid=0 -S execve -k root_action
...
- 113
1
vote
3
answers
4k
views
problem of setting audit rules: Syscall name unknown: stime
I am setting audit rules in /etc/audit/audit.rules.
As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.
So I add one line into /...
- 195
1
vote
1
answer
376
views
Audit log emails not going to the correct address
On Ubuntu 20, I'm trying to send audit logs to [email protected]. I do have a real domain and email server but I'm redacting them here. When I trigger an audit event, the email is instead sent ...
- 83