2022 Developer Survey is open! Take survey.

Questions tagged [auditd]

auditd is the userspace component to the Linux Auditing System.

Filter by
Sorted by
Tagged with
0 votes
1 answer
28 views

CIS compliant auditd configuration on Red Hat 7/8

We have a large fleet of Red Hat 7/8 systems. We have a requirement to make sure that all systems are CIS compliant. One of the requirement is to not automatically rotate the audit logs. That is, ...
user avatar
  • 61
1 vote
0 answers
38 views

auditd killing a server?

In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"): ... audit: audit_backlog=32769 > audit_backlog_limit=...
user avatar
  • 21
0 votes
0 answers
33 views

Logging user creation and deletion with auditd

What is the best way to log/detect user creation on linux machines by using auditd? I was thinking about logging calls to /usr/bin/ and /usr/sbin/ and filtering out useradd, adduser, deluser and ...
user avatar
  • 103
1 vote
0 answers
56 views

stop kernel audit messages logged in syslog without disabling auditing

OS: CentOS 7 I am trying to figure out how audit (kaudit) events are logged in /var/log/messages. I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
user avatar
  • 1,595
1 vote
1 answer
117 views

Auditd not sending logs to centralized auditd log server

We have set up centralized logging of auditd messages for two machines: machine (www22.domain.com) is the source (centos8) machine (cls.domain.com) is the centralized log server (centos7) This was ...
user avatar
1 vote
1 answer
1k views

CentOS doesn't boot with "A stop job is running for Security Auditing Service" message

CentOS prints the following during boot [ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s) and then switches into the single user mode.
user avatar
  • 41
1 vote
1 answer
48 views

Log execve's, along with parent process argv?

I'm trying to figure out if I can decomission an old server. I need the information about automated processes running there. So far I tried the following: auditctl -a exit,always -F arch=b64 -S ...
user avatar
  • 302
1 vote
0 answers
94 views

selinux - why can't stuff_u with sysadm_r run postsuper?

I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand. According to redhat SELinux User Capabilities stuff_u users should be ...
user avatar
  • 11
1 vote
0 answers
84 views

Monitoring IPv6 connection via auditd

some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection I'have found helpful article about that - Finding short-lived TCP ...
user avatar
0 votes
0 answers
30 views

why auditd not monitor/report adhoc log file?

I tried to watch my adhoc alert.log file with auditd, but I don't know why it does not work. I found no related entries in the auditd.log file. # auditctl -w /tmp/alert1.log -p wa -k alert # # ...
user avatar
  • 115
0 votes
1 answer
261 views

How to install `aide` without `aide-common` in debian?

Per this post, Newer versions of Ubuntu (including 14.04) come with two packages for AIDE: aide, with the aide command and manual page, and little else aide-common, with a wrapper around that ...
user avatar
  • 825
0 votes
0 answers
20 views

Troubleshooting auditd rules

I'm running RHEL 7.x. We have recently installed the DISA recommended rules for auditd. Since we've installed these new audit rules, we've noticed a significant decrease in system performance. Ex: ...
user avatar
  • 227
0 votes
1 answer
92 views

how send alert message from script to auditd.log?

Due to auditing policies ( auditd.log is monitored), I have to send alert messages from my adhoc check scripts to auditd.log. Any idea what is best / standard solution ? I think that echo log >>...
user avatar
  • 115
1 vote
2 answers
112 views

Issue with running Linux Audit System in a nested Virtual Machine inside Google Cloud Engine

I am trying to run the Linux audit system in a nested Virtual machine on the google cloud engine. The problem I am facing is that the Linux Audit System suspends after showing the following error ...
user avatar
1 vote
0 answers
71 views

CentOS USER_CMD logs auditd

We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it? We already getting commands, starting with sudo, but not ...
user avatar
1 vote
0 answers
60 views

Tracking TCP Connection in background

I am looking for a daemon utility to track all non local TCP connections and which binaries establish the TCP connections (actively and passively) with which IPs and ports. auditd seems like a great ...
user avatar
  • 235
1 vote
0 answers
73 views

Filtering auditd log entries by msg content

I want to filter out this messages. They are generated by the user crontabs running every minute: type=USER_END msg=audit(1611873842.675:459608): pid=19114 uid=0 auid=10061 ses=480462 subj==unconfined ...
user avatar
  • 11
0 votes
1 answer
70 views

selinux audit rule not logging anything

I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
user avatar
-1 votes
1 answer
167 views

Email alert when private keys read from disk (honeypot, auditd)

I'd like to receive an immediate alert every time something reads the contents of my private key on Debian Linux. How can I do that? I have an RSA private key stored on my server's disk at the ...
user avatar
1 vote
0 answers
164 views

Auditd to CloudwatchLogs to IDS alerts?

I'm administering a relatively simple AWS stack with about 5 heterogeneous Linux EC2 instances. All instances already have been setup to ship important logs to Cloudwatch Logs. Now I want to setup a ...
user avatar
  • 158
0 votes
0 answers
28 views

Auditd - track commands (regular and sudo) of a given UID

I have some auditd rules like: -a always,exit -F arch=b32 -S execve -F euid=1002 -k mytag -a always,exit -F arch=b64 -S execve -F euid=1002 -k mytag -a always,exit -F arch=b32 -S execve -F euid=1003 -...
user avatar
  • 32
0 votes
0 answers
29 views

Is it possible to ensure detection and logging of all attempts to copy data out of a system?

Say I have a server set-up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive data out of the platform, but could in principle do so ...
user avatar
0 votes
0 answers
624 views

How to get auditd started in CentOS Linux release 8.2.2004?

I did sudo yum reinstall audit on my server running CentOS Linux release 8.2.2004. When I tried systemctl start auditd it failed. When I ran journalctl -xe I received the following output: -- Unit ...
user avatar
  • 123
1 vote
1 answer
1k views

RHEL: Splitting auditd logs into multiple files for different rules

We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance. One problem we are having is that certain rules ...
user avatar
  • 151
0 votes
0 answers
118 views

Why does auditd report UID 1001 is trying to mount a disk when Ubuntu upon boot?

I'm seeing a message from auditd I don't understand. My OS is Ubuntu 20.04. Every time I boot the server, an audit entry says user id 1001 (a normal user) is making a syscall to /usr/bin/mount. But ...
user avatar
  • 105
0 votes
1 answer
209 views

Auditd not sending to remote central server

I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server. Note: instead of going to /etc/audisp/, these ...
user avatar
  • 3
0 votes
1 answer
1k views

I am trying to setup some auditd rules but getting error -F missing operation for auid

i am trying to setup the below rule in /etc/audit/audit.rules -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete which didn't work so i tried ...
user avatar
0 votes
1 answer
384 views

use linux auditd to log absolute everything

im trying to audit an automated task that connect to my server and exec some commands. I would like to know everything it does. Currently Im trying these rules at my audit.rules file. -a exit,always -...
user avatar
1 vote
1 answer
221 views

How can one identify what changes the SELinux file context of a file?

I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
user avatar
0 votes
1 answer
27 views

Conflic install package solution?

I need to install auditd from package because my CentOS 6.6 server can't use yum update. But I got some problem and can't install them: rpm -i audit-libs-2.4.5-6.el6.i686.rpm audit-2.4.5-6.el6.i686....
user avatar
0 votes
1 answer
405 views

Auditing user activity when using SSH Certificates

I have been reading a lot lately on SSH Certificates and i love the advantages it brings. Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
user avatar
0 votes
1 answer
46 views

Logging changes to file change/modify attributes

System is Centos8 I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these ...
user avatar
  • 774
0 votes
2 answers
921 views

Disable cron messages in auditd

I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS. For example, even if my /etc/audit/audit.rules contains no rules: -...
user avatar
  • 123
1 vote
0 answers
26 views

Ubuntu - Don't apply audit policy for specific process

I am using a 3rd party logging service (LogDNA) to centralise my server logs, but the agent installed on the server is actually causing the generation of additional and unnecessary logs. My audit ...
user avatar
0 votes
1 answer
193 views

How to configure auditd to collect logs from /proc kernel file directory

I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk. To do this I need to be ...
user avatar
1 vote
0 answers
1k views

How can I control the audit backlog limit without the auditd package installed?

I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
user avatar
  • 11
1 vote
1 answer
874 views

Configure auditd to monitor the execution of only one command

We have Ansible in place I want to set up audit which logs who executes a play.. I want therefore only monitor the execution of the command ansible or ansible-playbook. I can configure Ansible to ...
user avatar
  • 11
0 votes
1 answer
256 views

Connections shows up in tcpdump but cannot not in auditd or ss

I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections. I ...
user avatar
  • 15
0 votes
1 answer
358 views

Debugging how symbolic link is getting broken in ubuntu?

I have a symbolic link of the form ubuntu@platform1:~$ ls -lrt total 28 drwxr-xr-x 4 ubuntu ubuntu 4096 Mar 2 15:02 deploy lrwxrwxrwx 1 ubuntu ubuntu 14 May 25 18:27 logs -> /var/log/arkin ...
user avatar
  • 295
0 votes
1 answer
1k views

Auditd Log all executions except some scripts

I configured my auditd to log all execve syscalls using these rules: -a exit,always -F arch=b32 -S execve -a exit,always -F arch=b64 -S execve While this perfectly captures all activity of any user ...
user avatar
  • 3
5 votes
1 answer
7k views

What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?

My server is centos7.6 with auditd 2.8.5 In audit rule, I set: -a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change But this rule also record normal ntpd activities,then I tried ...
user avatar
  • 825
0 votes
1 answer
926 views

How can `auditd` log in `/var/log/audit/audit.log` even `auditctl -l` is empty?

My server is centos7.6 [root@localhost /]# auditctl -l No rules [root@localhost /]# cat /var/log/audit/audit.log type=CRED_REFR msg=audit(1552434501.528:25860): pid=12659 uid=0 auid=0 ses=3578 msg='...
user avatar
  • 825
0 votes
0 answers
662 views

Trying to enable auditd but svcadm not in solaris 10

I am new to Solaris. environment: Solaris 10/ i386 Here's my problem: I want to enable auditd to start generating system auditing log file. (Like service aduitd start in CentOS.) And every guide I ...
user avatar
4 votes
2 answers
1k views

Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)

My auditd rules and my needs are fairly simple, I want only to log root actions. # auditctl -l -a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION That is the only rule, and it works: type=...
user avatar
1 vote
0 answers
767 views

Auditd how to exclude everything

I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant. -a never,exclude -F msgtype=CWD -a ...
user avatar
2 votes
0 answers
990 views

Auditd - log all ssh sessions

We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
user avatar
  • 357
0 votes
1 answer
697 views

Record ssh REMOTE_USER in audit or history logs

In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys. Now, quite a few people work on those servers and sometimes we need to ...
user avatar
  • 133
1 vote
1 answer
241 views

Permission denied when adding audit rule in audisp plugin

I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
user avatar
2 votes
1 answer
2k views

Name rotated auditd logs with date

Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have audit.log audit.log.1 audit.log.2 ... When audit.log fills up all of the files are rotated one number ...
user avatar
  • 1,033
1 vote
1 answer
171 views

Audit file modifications over ssh in linux

I wanted to monitor all the modifications made to a file in a Linux server (Redhat). I made some research and found this auditing tool which I have already installed and configured using following ...
user avatar