I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as a perl or python script.
I would like to log when any user launches these specific binaries. The information I would like from this is basically:
- the name/path of the executable
- the arguments given to the executable
- the user who performed the action
- the date/time
Furthermore, I would like this information to be in a format which is logical to parse if needed.
Auditd looked like a good choice at first, but it has a strange way of splitting up the information above into two entries for some reason. For example, in the example above, I want to track running of the program /usr/bin/execute. I will add these statements to the auditctl:
-a exit,always -F arch=b32 -S execve -a exit,always -F arch=b64 -S execve
(I have not yet been able to find how to specify "/usr/bin/execute" as the only thing logged, I would appreciate help from someone who knows how to do this)
In the log after running /usr/bin/execute with one argument, I get the following two relevent entries:
type=SYSCALL msg=audit(1447688181.106:819746): arch=c000003e syscall=59 success=yes exit=0 a0=2898528 a1=26e3308 a2=2720008 a3=7fff176c1840 items=3 ppid=10697 pid=10715 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts4 ses=8 comm="execute" exe="/usr/bin/perl" key=(null) type=EXECVE msg=audit(1447688181.106:819746): argc=3 a0="/usr/bin/perl" a1="/usr/bin/execute" a2="some_arg.txt"
The information is for some reason being split between two entries. In the first SYSCALL message I get the uid of the user, and in the second EXECVE message I get the path (in 'a1', which I am not sure is consistant) and the arguments. In addition to the fact that this is more difficult to parse, I do not have a definite link between these statements to reconcile that they are part of the same event. This whole output seems to be generally incorrect for what I am trying to accomplish, so I am looking for a better way.
Tl;Dr: Can I get auditd to log this information to a file in a generally parse-able way, for scripts or binaries? Can I limit logging to only this executable file? If not, would another auditing daemon be a better choice?