Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [auditd]

auditd is the userspace component to the Linux Auditing System.

3
votes
2answers
42 views

Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)

My auditd rules and my needs are fairly simple, I want only to log root actions. # auditctl -l -a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION That is the only rule, and it works: type=...
0
votes
0answers
15 views

auditd exclude logging SSH user

Linux 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux auditd-2.6.7-2 amd64 There's user (user1 - auid=1002) - ssh account (SSH tunnel for remote MySQL connections). I need ...
1
vote
0answers
22 views

Auditd how to exclude everything

I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant. -a never,exclude -F msgtype=CWD -a ...
1
vote
0answers
53 views

Auditd - log all ssh sessions

We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
0
votes
1answer
75 views

Record ssh REMOTE_USER in audit or history logs

In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys. Now, quite a few people work on those servers and sometimes we need to ...
1
vote
1answer
41 views

Permission denied when adding audit rule in audisp plugin

I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
0
votes
1answer
17 views

Name rotated auditd logs with date

Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have audit.log audit.log.1 audit.log.2 ... When audit.log fills up all of the files are rotated one number ...
1
vote
1answer
37 views

Audit file modifications over ssh in linux

I wanted to monitor all the modifications made to a file in a Linux server (Redhat). I made some research and found this auditing tool which I have already installed and configured using following ...
0
votes
1answer
96 views

auditlog filling up without any rules

I have set up certain audit rules however audit log is filling up with unnecessary events which I don't want to log. is there any way that auditd will log only defined rule-based logs. OS: -Rhel 7.3
1
vote
2answers
101 views

How to determine process which makes DNS Request? [duplicate]

I have a server on AWS, GuardDuty started send me notifications: *** "type":"Backdoor:EC2/C&CActivity.B!DNS", *** {"domain":"libcurl.so","protocol":"UDP","blocked":false} *** is querying a domain ...
0
votes
1answer
42 views

Using auditd and retaining log files for 6 months.

Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities Task: Find a way to log all account management activities (e.g., account ...
1
vote
1answer
107 views

View auditd logs in journalctl

I'm using CentOS 7. trying to view auditd logs in journalctl When I try journalctl -u auditd I see the following output: -- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 ...
2
votes
3answers
79 views

Password change audit on solaris

Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts? I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
83 views

ausearch to filter audit logs to show only read, write , attribute changes in file

I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit). I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc. ...
0
votes
0answers
219 views

How to view audit logs on the server

I'm trying to do a nfs share. I've configured the share. Now I want to view the logs associated with the files in the nfs share. I've created a centralized log server. I don't know the difference ...
0
votes
1answer
35 views

How to configure auditd to record all the activity from events which run with WinSCP

I have a requirement from a customer (I have no idea if it can be implemented, after days of searching). This is the request: "The auditlog rules should be extended for events (create, delete, update, ...
1
vote
1answer
618 views

Redirect Auditd.log data to rsyslog in RHEL-7

I would like to redirect the auditd log data into rsyslog instead of audit.log file. I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to ...
0
votes
2answers
88 views

Linux SSH audit for failed root login

Let's assume there are two servers ( Server A and Server B ). I am seeing root ssh failed login attempted from Server A to Server B. ssh for root login has been disabled for both of the severs. I ...
1
vote
0answers
89 views

auditctl doesn't stores reads

So I have this rule on auditctl: -w /home/ec2-user/myfile -p rwa -k key-name But when I run ausearch -f /home/ec2-user/myfile or check the logs in /var/log/audit/audit.log, I can't see any ...
1
vote
1answer
56 views

Can auditd logs be modified? (Security, shell monitoring)

I recently set up auditd and enabled TTY logging so I could give someone non-root shell access and monitor what they're doing. (For what it's worth I gave them jailshell access, a cPanel feature that ...
0
votes
0answers
25 views

Auditing file names containing spaces with auditd

In Ubuntu 14.04, auditing file names containing spaces with auditd, is this possible? I tried -w "/home/leroy/Technical information.odt" -k test using auditctl and it was added. However, putting ...
0
votes
0answers
45 views

Can auditd log events from an specific executable?

I'm trying to set up some rules in order to monitor certain FS in a Ubuntu server box, without SE Linux. So far I was able to exclude certain syscalls but that's not what I need, I'm looking forward ...
0
votes
0answers
114 views

Restart of auditd causes audispd reconfigure infinite loop

We restart some of our services on Debian jessie every night at 11:45 PM as part of logfile rotation. Among those services that we restart is the auditd service. We are sometimes seeing that audispd ...
1
vote
0answers
34 views

Ubuntu 14.04.5 Need To Know If/When auditd Stops/Crashes

I have a security requirement to take some action (halt or reboot to single user mode) when/if auditd stops or crashes. I have set up auditd.conf to handle running out of disk space. Somehow I don't ...
1
vote
0answers
168 views

Solaris 11 Auditing, audit_control file cannot be found

First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more. From the ...
0
votes
1answer
22 views

auditd cache activity filtering?

Can anyone suggest a strategy for filtering browser cache activity from auditable events in CentOS6. Apparently el7 has added capabilities for filtering on executables? But all of our workstation ...
1
vote
1answer
68 views

auditctl: Error - nested rule files not supported

I'm trying to list the rules in a rules file using auditctl, whenever I do: auditctl -R audit.rules -l; I receive the error Error - nested rule files not supported. I've gone so far as to empty the ...
0
votes
1answer
367 views

How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]

I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
0
votes
1answer
58 views

Why does auditd only log `echo` when I use the absolute path?

Info Running auditd version 2.6.5 on Centos 7. My rules file contains: -a exit,always -F arch=b64 -F auid=0 -S execve -k root_action -a exit,always -F arch=b32 -F auid=0 -S execve -k root_action ...
0
votes
0answers
38 views

Is there anyway to log all system calls with DTrace?

I installed DTrace on Ubuntu by the following command: sudo apt-get install systemtap-sdt-dev Is there anyway to log all system calls with DTrace (it is possible by auditd but it crashes after 20 ...
2
votes
1answer
3k views

Problems with auditd rules files

I have a problem generating auditd rules on CentOS 7. I have 2 .rules files in my /etc/audit/rules.d/ directory. Both files are owned by root and only root has access. When I reload the rules using ...
0
votes
2answers
484 views

How to prevent logging USER_AUTH and USER_LOGIN events with auditd

I am trying to log changes to a file system using auditd, but I am seeing also many other things being logged, for example all failed SSH logging attempts (USER_AUTH and USER_LOGIN events). How can I ...
0
votes
0answers
580 views

Sending auditd logs to Splunk

Is it possible to send auditd logs from a server to Splunk, using audispd and its plugin audisp-remote? I configured audispd and audisp-remote but it doesnt work, audispd doesn't send anything.My ...
0
votes
1answer
132 views

CentOS 7.3 audit2allow return “plural forms expression could be dangerous”

Hi I try to check audit2why or audit2allow but I get error: cat /var/log/audit/audit.log | audit2why plural forms expression could be dangerous I have just installed latest CentOS from repos, using ...
2
votes
0answers
89 views

How do I audit cgroup changes

I have a container process that is mysteriously changing cgroups long after it has been started. How do I track down who/what is changing it? I tried watching my audit log when manually doing a ...
0
votes
1answer
191 views

auditd not logging file actions properly

I have a Linux machine where I have configured an audit rule for monitoring any types of changes on a file. This is the rule I placed in /etc/audit/audit.rules file: -w /home/ec2-user/splunk-test/...
0
votes
1answer
886 views

suppress audit events from a specific user

I'm trying to track down the source cause of a breakin on a serverhosting customer's website. auditd is a great help in showing me what directory to look in when yet another bit of malware (the site ...
2
votes
2answers
742 views

What's stopping auditd from logging writes by Syslog when watching a Syslog file?

We've recently started using auditd on one of our Ubuntu servers. The example audit.rules file we were given has a rule like this: -w /var/log/syslog -p wra -k logs However, when syslog writes to ...
0
votes
0answers
373 views

How do I get auditd to show me the folder/file name of something it's monitoring, when the changes are made via an smb client?

I'm using auditd to audit a folder, /shared, for read, write, attribute changes and deletions. I have installed auditd and configured the following rules: -a exit,always -S unlink -S rmdir -a exit,...
1
vote
0answers
66 views

Centos 7 auditing pipe-user-pages-soft being exceeded

The following patch introduced behaviour where a user has the default buffer size of new pipes changed if the total amount of memory used by pipes exceeds a threshold. https://lkml.org/lkml/2016/1/18/...
1
vote
1answer
514 views

auditd doesn't log chmod at all

I run the following, with the idea that I want to log any changes to the permissions of the home/username directory: auditctl -w /home/username -p a Then I run the following: tail -f /var/log/audit/...
1
vote
0answers
229 views

CoreOS logs flooded with “Unknown permission status for class system”

I am trying to debug an issue, and I was wondering if this rings a bell to anyone: My logs get flooded with audit: type=1107 audit(1479418315.344:1053): pid=1 uid=0 auid=4294967295 ses=4294967295 ...
2
votes
0answers
397 views

Linux Auditd tracking writes on external media

So I've been looking at ways to audit when a form of external media performs writes/ uploads on a Linux system. Currently the main solution I have come across is to simply audit when the mount and ...
2
votes
2answers
3k views

What is the syslog facility for auditd logs?

Trying to forward only my auditd events by syslog, but I don't know which facility to use. I don't want to send everything to my syslog server as it would create redundancy in logging. I've set the ...
0
votes
1answer
257 views

Can aureport show filenames for read/write access reporting?

I installed auditd this evening in the hopes of using it to report on files written or appended to within a directory tree on my server. I have successfully configured rules using auditctl, but I ...
0
votes
1answer
81 views

Centos Audit.log is full of no relevant information

My audit.log file is full of information that i font need (and want to disable) A lot of log lines like: type=SYSCALL msg=audit(1467201475.671:36911834): arch=c000003e syscall=2 success=yes exit=49 ...
0
votes
1answer
1k views

Restarting audit on El Capitan

I want to monitor process startup on El Capitan. Darwin MaeLucirdosiMac.home 15.5.0 Darwin Kernel Version 15.5.0: Tue Apr 19 18:36:36 PDT 2016; root:xnu-3248.50.21~8/RELEASE_X86_64 x86_64 Below is ...
0
votes
1answer
710 views

auditd - Getting only EXECVE in ausearch?

I'd like to use the auditd daemon to log whatever is run as or by root on our servers. To that effect, I added the following lines to /etc/audit/audit.rules: # Log all commands run as (or by) root -a ...
1
vote
0answers
119 views

How to record audit logs for only one specified file in FreeBSD?

On Red Hat Linux I can specify the file I want to record audit logs for with this command: auditctl -a exit,always -F path=/tmp/foo.txt -F perm=war I cannot figure out how to do a similar thing on ...
2
votes
2answers
1k views

How to tell if auditd has suspended logging?

If you put the following in your auditd.conf, auditd will suspend logging when you have 50MB or less space on your disk: admin_space_left = 50 admin_space_left_action = SUSPEND How can an external ...