Questions tagged [auditd]
auditd is the userspace component to the Linux Auditing System.
3
votes
2answers
42 views
Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)
My auditd rules and my needs are fairly simple, I want only to log root actions.
# auditctl -l
-a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION
That is the only rule, and it works:
type=...
0
votes
0answers
15 views
auditd exclude logging SSH user
Linux 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux auditd-2.6.7-2 amd64
There's user (user1 - auid=1002) - ssh account (SSH tunnel for remote MySQL connections). I need ...
1
vote
0answers
22 views
Auditd how to exclude everything
I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant.
-a never,exclude -F msgtype=CWD
-a ...
1
vote
0answers
53 views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
0
votes
1answer
75 views
Record ssh REMOTE_USER in audit or history logs
In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys.
Now, quite a few people work on those servers and sometimes we need to ...
1
vote
1answer
41 views
Permission denied when adding audit rule in audisp plugin
I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
0
votes
1answer
17 views
Name rotated auditd logs with date
Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have
audit.log
audit.log.1
audit.log.2
...
When audit.log fills up all of the files are rotated one number ...
1
vote
1answer
37 views
Audit file modifications over ssh in linux
I wanted to monitor all the modifications made to a file in a Linux server (Redhat). I made some research and found this auditing tool which I have already installed and configured using following ...
0
votes
1answer
96 views
auditlog filling up without any rules
I have set up certain audit rules however audit log is filling up with unnecessary events which I don't want to log. is there any way that auditd will log only defined rule-based logs.
OS: -Rhel 7.3
1
vote
2answers
101 views
How to determine process which makes DNS Request? [duplicate]
I have a server on AWS, GuardDuty started send me notifications:
*** "type":"Backdoor:EC2/C&CActivity.B!DNS",
*** {"domain":"libcurl.so","protocol":"UDP","blocked":false}
*** is querying a domain ...
0
votes
1answer
42 views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
1
vote
1answer
107 views
View auditd logs in journalctl
I'm using CentOS 7. trying to view auditd logs in journalctl
When I try journalctl -u auditd I see the following output:
-- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 ...
2
votes
3answers
79 views
Password change audit on solaris
Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts?
I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
83 views
ausearch to filter audit logs to show only read, write , attribute changes in file
I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit).
I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc.
...
0
votes
0answers
219 views
How to view audit logs on the server
I'm trying to do a nfs share. I've configured the share.
Now I want to view the logs associated with the files in the nfs share.
I've created a centralized log server. I don't know the difference ...
0
votes
1answer
35 views
How to configure auditd to record all the activity from events which run with WinSCP
I have a requirement from a customer (I have no idea if it can be implemented, after days of searching). This is the request: "The auditlog rules should be extended for events (create, delete, update, ...
1
vote
1answer
618 views
Redirect Auditd.log data to rsyslog in RHEL-7
I would like to redirect the auditd log data into rsyslog instead of audit.log file.
I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to
...
0
votes
2answers
88 views
Linux SSH audit for failed root login
Let's assume there are two servers ( Server A and Server B ). I am seeing root ssh failed login attempted from Server A to Server B. ssh for root login has been disabled for both of the severs.
I ...
1
vote
0answers
89 views
auditctl doesn't stores reads
So I have this rule on auditctl:
-w /home/ec2-user/myfile -p rwa -k key-name
But when I run
ausearch -f /home/ec2-user/myfile
or check the logs in /var/log/audit/audit.log, I can't see any ...
1
vote
1answer
56 views
Can auditd logs be modified? (Security, shell monitoring)
I recently set up auditd and enabled TTY logging so I could give someone non-root shell access and monitor what they're doing. (For what it's worth I gave them jailshell access, a cPanel feature that ...
0
votes
0answers
25 views
Auditing file names containing spaces with auditd
In Ubuntu 14.04, auditing file names containing spaces with auditd, is this possible?
I tried
-w "/home/leroy/Technical information.odt" -k test
using auditctl and it was added.
However, putting ...
0
votes
0answers
45 views
Can auditd log events from an specific executable?
I'm trying to set up some rules in order to monitor certain FS in a Ubuntu server box, without SE Linux. So far I was able to exclude certain syscalls but that's not what I need, I'm looking forward ...
0
votes
0answers
114 views
Restart of auditd causes audispd reconfigure infinite loop
We restart some of our services on Debian jessie every night at 11:45 PM as part of logfile rotation. Among those services that we restart is the auditd service. We are sometimes seeing that audispd ...
1
vote
0answers
34 views
Ubuntu 14.04.5 Need To Know If/When auditd Stops/Crashes
I have a security requirement to take some action (halt or reboot to single user mode) when/if auditd stops or crashes. I have set up auditd.conf to handle running out of disk space. Somehow I don't ...
1
vote
0answers
168 views
Solaris 11 Auditing, audit_control file cannot be found
First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more.
From the ...
0
votes
1answer
22 views
auditd cache activity filtering?
Can anyone suggest a strategy for filtering browser cache activity from auditable events in CentOS6. Apparently el7 has added capabilities for filtering on executables? But all of our workstation ...
1
vote
1answer
68 views
auditctl: Error - nested rule files not supported
I'm trying to list the rules in a rules file using auditctl, whenever I do: auditctl -R audit.rules -l; I receive the error Error - nested rule files not supported. I've gone so far as to empty the ...
0
votes
1answer
367 views
How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]
I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
0
votes
1answer
58 views
Why does auditd only log `echo` when I use the absolute path?
Info
Running auditd version 2.6.5 on Centos 7.
My rules file contains:
-a exit,always -F arch=b64 -F auid=0 -S execve -k root_action
-a exit,always -F arch=b32 -F auid=0 -S execve -k root_action
...
0
votes
0answers
38 views
Is there anyway to log all system calls with DTrace?
I installed DTrace on Ubuntu by the following command:
sudo apt-get install systemtap-sdt-dev
Is there anyway to log all system calls with DTrace (it is possible by auditd but it crashes after 20 ...
2
votes
1answer
3k views
Problems with auditd rules files
I have a problem generating auditd rules on CentOS 7.
I have 2 .rules files in my /etc/audit/rules.d/ directory. Both files are owned by root and only root has access. When I reload the rules using ...
0
votes
2answers
484 views
How to prevent logging USER_AUTH and USER_LOGIN events with auditd
I am trying to log changes to a file system using auditd, but I am seeing also many other things being logged, for example all failed SSH logging attempts (USER_AUTH and USER_LOGIN events). How can I ...
0
votes
0answers
580 views
Sending auditd logs to Splunk
Is it possible to send auditd logs from a server to Splunk, using audispd and its plugin audisp-remote?
I configured audispd and audisp-remote but it doesnt work, audispd doesn't send anything.My ...
0
votes
1answer
132 views
CentOS 7.3 audit2allow return “plural forms expression could be dangerous”
Hi I try to check audit2why or audit2allow but I get error:
cat /var/log/audit/audit.log | audit2why
plural forms expression could be dangerous
I have just installed latest CentOS from repos, using ...
2
votes
0answers
89 views
How do I audit cgroup changes
I have a container process that is mysteriously changing cgroups long after it has been started. How do I track down who/what is changing it? I tried watching my audit log when manually doing a ...
0
votes
1answer
191 views
auditd not logging file actions properly
I have a Linux machine where I have configured an audit rule for monitoring any types of changes on a file. This is the rule I placed in /etc/audit/audit.rules file:
-w /home/ec2-user/splunk-test/...
0
votes
1answer
886 views
suppress audit events from a specific user
I'm trying to track down the source cause of a breakin on a serverhosting customer's website.
auditd is a great help in showing me what directory to look in when yet another bit of malware (the site ...
2
votes
2answers
742 views
What's stopping auditd from logging writes by Syslog when watching a Syslog file?
We've recently started using auditd on one of our Ubuntu servers.
The example audit.rules file we were given has a rule like this:
-w /var/log/syslog -p wra -k logs
However, when syslog writes to ...
0
votes
0answers
373 views
How do I get auditd to show me the folder/file name of something it's monitoring, when the changes are made via an smb client?
I'm using auditd to audit a folder, /shared, for read, write, attribute changes and deletions.
I have installed auditd and configured the following rules:
-a exit,always -S unlink -S rmdir
-a exit,...
1
vote
0answers
66 views
Centos 7 auditing pipe-user-pages-soft being exceeded
The following patch introduced behaviour where a user has the default buffer size of new pipes changed if the total amount of memory used by pipes exceeds a threshold.
https://lkml.org/lkml/2016/1/18/...
1
vote
1answer
514 views
auditd doesn't log chmod at all
I run the following, with the idea that I want to log any changes to the permissions of the home/username directory:
auditctl -w /home/username -p a
Then I run the following:
tail -f /var/log/audit/...
1
vote
0answers
229 views
CoreOS logs flooded with “Unknown permission status for class system”
I am trying to debug an issue, and I was wondering if this rings a bell to anyone: My logs get flooded with
audit: type=1107 audit(1479418315.344:1053): pid=1 uid=0 auid=4294967295 ses=4294967295 ...
2
votes
0answers
397 views
Linux Auditd tracking writes on external media
So I've been looking at ways to audit when a form of external media performs writes/ uploads on a Linux system. Currently the main solution I have come across is to simply audit when the mount and ...
2
votes
2answers
3k views
What is the syslog facility for auditd logs?
Trying to forward only my auditd events by syslog, but I don't know which facility to use. I don't want to send everything to my syslog server as it would create redundancy in logging. I've set the ...
0
votes
1answer
257 views
Can aureport show filenames for read/write access reporting?
I installed auditd this evening in the hopes of using it to report on files written or appended to within a directory tree on my server. I have successfully configured rules using auditctl, but I ...
0
votes
1answer
81 views
Centos Audit.log is full of no relevant information
My audit.log file is full of information that i font need (and want to disable)
A lot of log lines like:
type=SYSCALL msg=audit(1467201475.671:36911834): arch=c000003e syscall=2 success=yes exit=49 ...
0
votes
1answer
1k views
Restarting audit on El Capitan
I want to monitor process startup on El Capitan.
Darwin MaeLucirdosiMac.home 15.5.0 Darwin Kernel Version 15.5.0: Tue Apr 19 18:36:36 PDT 2016; root:xnu-3248.50.21~8/RELEASE_X86_64 x86_64
Below is ...
0
votes
1answer
710 views
auditd - Getting only EXECVE in ausearch?
I'd like to use the auditd daemon to log whatever is run as or by root on our servers. To that effect, I added the following lines to /etc/audit/audit.rules:
# Log all commands run as (or by) root
-a ...
1
vote
0answers
119 views
How to record audit logs for only one specified file in FreeBSD?
On Red Hat Linux I can specify the file I want to record audit logs for with this command:
auditctl -a exit,always -F path=/tmp/foo.txt -F perm=war
I cannot figure out how to do a similar thing on ...
2
votes
2answers
1k views
How to tell if auditd has suspended logging?
If you put the following in your auditd.conf, auditd will suspend logging when you have 50MB or less space on your disk:
admin_space_left = 50
admin_space_left_action = SUSPEND
How can an external ...
