Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [auditd]

auditd is the userspace component to the Linux Auditing System.

0
votes
1answer
23 views

auditlog filling up without any rules

I have set up certain audit rules however audit log is filling up with unnecessary events which I don't want to log. is there any way that auditd will log only defined rule-based logs. OS: -Rhel 7.3
1
vote
2answers
64 views

How to determine process which makes DNS Request? [duplicate]

I have a server on AWS, GuardDuty started send me notifications: *** "type":"Backdoor:EC2/C&CActivity.B!DNS", *** {"domain":"libcurl.so","protocol":"UDP","blocked":false} *** is querying a domain ...
0
votes
1answer
16 views

Using auditd and retaining log files for 6 months.

Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities Task: Find a way to log all account management activities (e.g., account ...
1
vote
1answer
56 views

View auditd logs in journalctl

I'm using CentOS 7. trying to view auditd logs in journalctl When I try journalctl -u auditd I see the following output: -- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 ...
2
votes
3answers
47 views

Password change audit on solaris

Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts? I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
55 views

ausearch to filter audit logs to show only read, write , attribute changes in file

I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit). I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc. ...
0
votes
0answers
20 views

auditing a specific user activity in centos [duplicate]

I have created a user for a specific purpose and gave it to a team member. Now I want to keep track of all his executed commands (failed/successful). I have added "auditctl -a exit,always -F auid=...
0
votes
0answers
119 views

How to view audit logs on the server

I'm trying to do a nfs share. I've configured the share. Now I want to view the logs associated with the files in the nfs share. I've created a centralized log server. I don't know the difference ...
0
votes
1answer
30 views

How to configure auditd to record all the activity from events which run with WinSCP

I have a requirement from a customer (I have no idea if it can be implemented, after days of searching). This is the request: "The auditlog rules should be extended for events (create, delete, update, ...
1
vote
1answer
299 views

Redirect Auditd.log data to rsyslog in RHEL-7

I would like to redirect the auditd log data into rsyslog instead of audit.log file. I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to ...
0
votes
2answers
45 views

Linux SSH audit for failed root login

Let's assume there are two servers ( Server A and Server B ). I am seeing root ssh failed login attempted from Server A to Server B. ssh for root login has been disabled for both of the severs. I ...
1
vote
0answers
58 views

auditctl doesn't stores reads

So I have this rule on auditctl: -w /home/ec2-user/myfile -p rwa -k key-name But when I run ausearch -f /home/ec2-user/myfile or check the logs in /var/log/audit/audit.log, I can't see any ...
1
vote
1answer
45 views

Can auditd logs be modified? (Security, shell monitoring)

I recently set up auditd and enabled TTY logging so I could give someone non-root shell access and monitor what they're doing. (For what it's worth I gave them jailshell access, a cPanel feature that ...
0
votes
0answers
21 views

Auditing file names containing spaces with auditd

In Ubuntu 14.04, auditing file names containing spaces with auditd, is this possible? I tried -w "/home/leroy/Technical information.odt" -k test using auditctl and it was added. However, putting ...
0
votes
0answers
28 views

Can auditd log events from an specific executable?

I'm trying to set up some rules in order to monitor certain FS in a Ubuntu server box, without SE Linux. So far I was able to exclude certain syscalls but that's not what I need, I'm looking forward ...
0
votes
0answers
58 views

Restart of auditd causes audispd reconfigure infinite loop

We restart some of our services on Debian jessie every night at 11:45 PM as part of logfile rotation. Among those services that we restart is the auditd service. We are sometimes seeing that audispd ...
1
vote
0answers
27 views

Ubuntu 14.04.5 Need To Know If/When auditd Stops/Crashes

I have a security requirement to take some action (halt or reboot to single user mode) when/if auditd stops or crashes. I have set up auditd.conf to handle running out of disk space. Somehow I don't ...
1
vote
0answers
111 views

Solaris 11 Auditing, audit_control file cannot be found

First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more. From the ...
0
votes
1answer
22 views

auditd cache activity filtering?

Can anyone suggest a strategy for filtering browser cache activity from auditable events in CentOS6. Apparently el7 has added capabilities for filtering on executables? But all of our workstation ...
0
votes
1answer
48 views

auditctl: Error - nested rule files not supported

I'm trying to list the rules in a rules file using auditctl, whenever I do: auditctl -R audit.rules -l; I receive the error Error - nested rule files not supported. I've gone so far as to empty the ...
0
votes
0answers
48 views

Why do some System Call Audit Rules omit the -S Flag?

I've been tasked with adding some audit rules to our audit system, so I'm educating myself about the kernel audit system. I'm currently learning how to read audit rules, and it looks like some of ...
0
votes
0answers
30 views

Changes made with chattr are not detected by auditd

I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using: auditctl -w /etc/my_path_to_monitor -p wa -k my_rule This works great for everything ...
0
votes
1answer
286 views

How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]

I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
0
votes
1answer
45 views

Why does auditd only log `echo` when I use the absolute path?

Info Running auditd version 2.6.5 on Centos 7. My rules file contains: -a exit,always -F arch=b64 -F auid=0 -S execve -k root_action -a exit,always -F arch=b32 -F auid=0 -S execve -k root_action ...
0
votes
0answers
35 views

Is there anyway to log all system calls with DTrace?

I installed DTrace on Ubuntu by the following command: sudo apt-get install systemtap-sdt-dev Is there anyway to log all system calls with DTrace (it is possible by auditd but it crashes after 20 ...
1
vote
1answer
2k views

Problems with auditd rules files

I have a problem generating auditd rules on CentOS 7. I have 2 .rules files in my /etc/audit/rules.d/ directory. Both files are owned by root and only root has access. When I reload the rules using ...
0
votes
2answers
336 views

How to prevent logging USER_AUTH and USER_LOGIN events with auditd

I am trying to log changes to a file system using auditd, but I am seeing also many other things being logged, for example all failed SSH logging attempts (USER_AUTH and USER_LOGIN events). How can I ...
0
votes
0answers
476 views

Sending auditd logs to Splunk

Is it possible to send auditd logs from a server to Splunk, using audispd and its plugin audisp-remote? I configured audispd and audisp-remote but it doesnt work, audispd doesn't send anything.My ...
0
votes
1answer
117 views

CentOS 7.3 audit2allow return “plural forms expression could be dangerous”

Hi I try to check audit2why or audit2allow but I get error: cat /var/log/audit/audit.log | audit2why plural forms expression could be dangerous I have just installed latest CentOS from repos, using ...
2
votes
0answers
72 views

How do I audit cgroup changes

I have a container process that is mysteriously changing cgroups long after it has been started. How do I track down who/what is changing it? I tried watching my audit log when manually doing a ...
0
votes
1answer
134 views

auditd not logging file actions properly

I have a Linux machine where I have configured an audit rule for monitoring any types of changes on a file. This is the rule I placed in /etc/audit/audit.rules file: -w /home/ec2-user/splunk-test/...
0
votes
1answer
650 views

suppress audit events from a specific user

I'm trying to track down the source cause of a breakin on a serverhosting customer's website. auditd is a great help in showing me what directory to look in when yet another bit of malware (the site ...
2
votes
2answers
661 views

What's stopping auditd from logging writes by Syslog when watching a Syslog file?

We've recently started using auditd on one of our Ubuntu servers. The example audit.rules file we were given has a rule like this: -w /var/log/syslog -p wra -k logs However, when syslog writes to ...
0
votes
0answers
306 views

How do I get auditd to show me the folder/file name of something it's monitoring, when the changes are made via an smb client?

I'm using auditd to audit a folder, /shared, for read, write, attribute changes and deletions. I have installed auditd and configured the following rules: -a exit,always -S unlink -S rmdir -a exit,...
1
vote
0answers
61 views

Centos 7 auditing pipe-user-pages-soft being exceeded

The following patch introduced behaviour where a user has the default buffer size of new pipes changed if the total amount of memory used by pipes exceeds a threshold. https://lkml.org/lkml/2016/1/18/...
1
vote
1answer
431 views

auditd doesn't log chmod at all

I run the following, with the idea that I want to log any changes to the permissions of the home/username directory: auditctl -w /home/username -p a Then I run the following: tail -f /var/log/audit/...
1
vote
0answers
205 views

CoreOS logs flooded with “Unknown permission status for class system”

I am trying to debug an issue, and I was wondering if this rings a bell to anyone: My logs get flooded with audit: type=1107 audit(1479418315.344:1053): pid=1 uid=0 auid=4294967295 ses=4294967295 ...
2
votes
0answers
352 views

Linux Auditd tracking writes on external media

So I've been looking at ways to audit when a form of external media performs writes/ uploads on a Linux system. Currently the main solution I have come across is to simply audit when the mount and ...
2
votes
2answers
2k views

What is the syslog facility for auditd logs?

Trying to forward only my auditd events by syslog, but I don't know which facility to use. I don't want to send everything to my syslog server as it would create redundancy in logging. I've set the ...
0
votes
1answer
216 views

Can aureport show filenames for read/write access reporting?

I installed auditd this evening in the hopes of using it to report on files written or appended to within a directory tree on my server. I have successfully configured rules using auditctl, but I ...
0
votes
1answer
76 views

Centos Audit.log is full of no relevant information

My audit.log file is full of information that i font need (and want to disable) A lot of log lines like: type=SYSCALL msg=audit(1467201475.671:36911834): arch=c000003e syscall=2 success=yes exit=49 ...
0
votes
1answer
968 views

Restarting audit on El Capitan

I want to monitor process startup on El Capitan. Darwin MaeLucirdosiMac.home 15.5.0 Darwin Kernel Version 15.5.0: Tue Apr 19 18:36:36 PDT 2016; root:xnu-3248.50.21~8/RELEASE_X86_64 x86_64 Below is ...
0
votes
1answer
611 views

auditd - Getting only EXECVE in ausearch?

I'd like to use the auditd daemon to log whatever is run as or by root on our servers. To that effect, I added the following lines to /etc/audit/audit.rules: # Log all commands run as (or by) root -a ...
1
vote
0answers
115 views

How to record audit logs for only one specified file in FreeBSD?

On Red Hat Linux I can specify the file I want to record audit logs for with this command: auditctl -a exit,always -F path=/tmp/foo.txt -F perm=war I cannot figure out how to do a similar thing on ...
2
votes
2answers
952 views

How to tell if auditd has suspended logging?

If you put the following in your auditd.conf, auditd will suspend logging when you have 50MB or less space on your disk: admin_space_left = 50 admin_space_left_action = SUSPEND How can an external ...
4
votes
2answers
1k views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN msg=audit(...
0
votes
1answer
378 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
1
vote
0answers
71 views

Audit only changes to files

I'm using Auditd to record any changes to files. Here is rule: # auditctl -l LIST_RULES: exit,always dir=/var/local/ (0x1e) perm=w key=state-files but if I run: # ausearch -i -k state-files ...
2
votes
1answer
958 views

How to enable syscall auditing in CoreOs?

Since CoreOs 766, the auditing subsystem is partially integrated: The audit subsystem has been enabled in the kernel and auditctl added to the image. Most audit events are ignored by default. The ...
0
votes
0answers
52 views

Trying to find a trojan with Auditctl. Not enough information

So I have a website in Wordpress that keeps getting infected and starts sending spam emails. I have set up rules on AuditCTL on my Centos 6 server to find the culprit script but the information is ...