0

I installed auditd this evening in the hopes of using it to report on files written or appended to within a directory tree on my server. I have successfully configured rules using auditctl, but I cannot find any way to get the ausearch or aureport commands to give me the filenames of the files touched - all I see is the inodes within the ausearch output.

Is there any command line option I can use to have them output mre useful information, or perhaps some other utility to make better sense of the audit log?

1 Answer 1

2

Can you advise what rules you are running? This is from a just patched Centos7 and as you can see one sees the file in the monitored directory in the last PATH record's of each event.

[root@centos7 burn]# auditctl -D
No rules
[root@centos7 burn]# auditctl -l
No rules
[root@centos7 burn]# auditctl -a exit,always -F dir=/data/special_files -F perm=rwa -k Sens_Data
[root@centos7 burn]# auditctl -l
-w /data/special_files/ -p rwa -k Sens_Data
[root@centos7 burn]# cp /etc/passwd /data/special_files/IamSpecial
[root@centos7 burn]# chmod 100 /data/special_files/IamSpecial
[root@centos7 burn]# ausearch -i -k Sens_Data
----
node=centos7.swtf.dyndns.org type=CONFIG_CHANGE msg=audit(07/13/2016 22:40:13.339:33409) : auid=burn ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="add_rule" key=Sens_Data list=exit res=yes 
----
node=centos7.swtf.dyndns.org type=PATH msg=audit(07/13/2016 22:40:38.313:33410) : item=1 name=/data/special_files/IamSpecial inode=545 dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:default_t:s0 objtype=CREATE 
node=centos7.swtf.dyndns.org type=PATH msg=audit(07/13/2016 22:40:38.313:33410) : item=0 name=/data/special_files/ inode=83980 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:default_t:s0 objtype=PARENT 
node=centos7.swtf.dyndns.org type=CWD msg=audit(07/13/2016 22:40:38.313:33410) :  cwd=/home/burn 
node=centos7.swtf.dyndns.org type=SYSCALL msg=audit(07/13/2016 22:40:38.313:33410) : arch=x86_64 syscall=open success=yes exit=4 a0=0x7ffe4c0a58e7 a1=O_WRONLY|O_CREAT|O_EXCL a2=0644 a3=0x7ffe4c0a36c0 items=2 ppid=2410 pid=13748 auid=burn uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=cp exe=/usr/bin/cp subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=Sens_Data 
----
node=centos7.swtf.dyndns.org type=PATH msg=audit(07/13/2016 22:40:54.344:33411) : item=0 name=/data/special_files/IamSpecial inode=545 dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:default_t:s0 objtype=NORMAL 
node=centos7.swtf.dyndns.org type=CWD msg=audit(07/13/2016 22:40:54.344:33411) :  cwd=/home/burn 
node=centos7.swtf.dyndns.org type=SYSCALL msg=audit(07/13/2016 22:40:54.344:33411) : arch=x86_64 syscall=fchmodat success=yes exit=0 a0=0xffffffffffffff9c a1=0x24e40f0 a2=0100 a3=0x7ffdba0b3c60 items=1 ppid=2410 pid=13749 auid=burn uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=chmod exe=/usr/bin/chmod subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=Sens_Data 
[root@centos7 burn]# rpm -q audit
audit-2.4.1-5.el7.x86_64
[root@centos7 burn]# 
1
  • Thanks @BurnA. I took another look at it the other night and did observe instances of what you indicated. It seemed inconsistent though - sometimes, I could see the correct path to the files, while in other cases, it only gave me the filename. Need to explore it a little more to make sense of it.
    – John Rix
    Jul 20, 2016 at 22:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .