I tried to watch my adhoc alert.log file with auditd, but I don't know why it does not work. I found no related entries in the auditd.log file.

# auditctl  -w /tmp/alert1.log  -p wa -k alert

# auditctl -l
-a never,task
-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change
-a always,exit -F arch=b32 -S stime,settimeofday,adjtimex -F key=time-change
-a always,exit -F arch=b64 -S clock_settime -F key=time-change
-a always,exit -F arch=b32 -S clock_settime -F key=time-change
-w /tmp/alert1.log -p wa -k alert

echo alert  >>  /tmp/alert1.log

Also tried to monitor logger activity with this:

-w /bin/logger -p x -k LOGGER_CALL

But it seems that it generates an alert only once, when I use the logger again, then the next logger alert is not watched/logged.

...EDIT I found some strange behavior, It works only when I use just these two rules>

-w /usr/bin/logger -p x -k LOGGER_CALL
-w /tmp/alert.log  -p wa -k alert

But when I use also with other rules, then it not worked, Can some other rules override my rules ? Another strange behavior > When I just clean / modify rules and restart auditd, it still is not working, I have to reboot the whole server .

Here are all the rules, where it did not work within.

-a task,never

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change

-a always,exit -F arch=b64 -S clock_settime -k time-change

-a always,exit -F arch=b32 -S clock_settime -k time-change

-w /etc/localtime -p wa -k time-change

-w /var/log/sudo.log -p wa -k actions

-w /etc/sudoers -p wa -k scope

-w /etc/sudoers.d/ -p wa -k scope

-w /var/run/utmp -p wa -k session

-w /var/log/wtmp -p wa -k logins

-w /var/log/btmp -p wa -k logins

-w /var/log/lastlog -p wa -k logins

-w /var/run/faillock/ -p wa -k logins

-w /etc/selinux/ -p wa -k MAC-policy

-w /usr/share/selinux/ -p wa -k MAC-policy

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale

-w /etc/issue -p wa -k system-locale

-w /etc/issue.net -p wa -k system-locale

-w /etc/hosts -p wa -k system-locale

-w /etc/sysconfig/network -p wa -k system-locale

-w /etc/sysconfig/network-scripts/ -p wa -k system-locale

-w /etc/group -p wa -k identity

-w /etc/passwd -p wa -k identity

-w /etc/gshadow -p wa -k identity

-w /etc/shadow -p wa -k identity

-w /etc/security/opasswd -p wa -k identity
-w /usr/bin/logger -p x -k LOGGER_CALL

-w /tmp/alert.log  -p wa -k alert

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.