Questions tagged [auditd]
auditd is the userspace component to the Linux Auditing System.
161
questions
1
vote
0
answers
18
views
How to set proctitle to ascii in auditd?
I configured auditd to send the logs to SIEM through rsyslog.
But when I get those logs the proctitle is in hex.
Ex.:
<134>Aug 25 17:08:44 vmauditd tag_audit_log: node=vmauditd type=PROCTITLE ...
- 111
1
vote
1
answer
81
views
auditd.conf - when is "verify_email" actually checked?
When using an email address in /etc/audit/auditd.conf, there is an option verify_email which is defined as,
This option determines if the email address given in action_mail_acct is checked to see if ...
- 83
0
votes
0
answers
518
views
Linux Auditd: Error receiving audit netlink packet (No buffer space available)
I have some Linux servers that are getting errors like the below in the logs...
auditd[1074]: Error receiving audit netlink packet (No buffer space available)
I know HOW to resolve the issue (tweak ...
- 151
1
vote
1
answer
131
views
Audit log emails not going to the correct address
On Ubuntu 20, I'm trying to send audit logs to [email protected]. I do have a real domain and email server but I'm redacting them here. When I trigger an audit event, the email is instead sent ...
- 83
0
votes
0
answers
73
views
How to configure osquery with auditd
Who has expertise on how to work with osquery (or maybe you solved this problem):
Based on articles like this one - https://blog.palantir.com/auditing-with-osquery-part-two-configuration-and-...
1
vote
2
answers
187
views
What can you do when auditd halts the system?
I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again ...
- 111
1
vote
1
answer
106
views
Auditd - Don't log events from salt-minion
I'm updating our Auditd rules (Red Hat Linux) to log all tty/interactive commands from all users. That part works no problem.
What I'm trying to do now is to exclude commands issued by our salt-...
- 151
0
votes
1
answer
94
views
Audit Log Partition keeps getting corrupted. How to prevent or boot anyway?
I am running RHEL7, and my audit log partition randomly (not often, but often enough to annoy me) gets corrupted, preventing me from booting. How can I either prevent the partition from being ...
- 61
1
vote
1
answer
304
views
Find process that makes outbound HTTP calls, trying auditd with syslog-ng
Some of application (it's unknown) makes sporadic nonregular rare short outbound HTTP(S) requests to a known host/port/url (this is a WAF honeypot, host/url/port is known) using HTTPS protocol.
...
- 846
0
votes
0
answers
67
views
Why Firefox is trying to access .bashrc?
This Ubuntu 22.04 installation is fairly new. Why firefox is trying to read .bashrc and many other files. Does this indicate a security breach?
[340664.822484] audit: type=1400 audit(1665738538.467:...
0
votes
0
answers
134
views
Auditd service mysteriously stopped after 2 minutes on Ubuntu
ubuntu:~$ systemctl status auditd
● auditd.service - Security Auditing Service
Loaded: loaded (/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: inactive (dead) since ...
- 1
1
vote
0
answers
101
views
Linux Auditd monitoring of file operations in mounted folder
I have multi node kubernetes cluster and I would like to monitor file operations that are made by containers in mounted persistent volume.
I found the all PV data are located at nodes in /var/lib/...
- 11
1
vote
0
answers
387
views
auditd - dir cannot be used with exclude filter?
I have a problem with auditd rules. I'd like to audit /opt/zimbra/mailboxd/webapps/ dir but without: zimbraAdmin/WEB-INF/,zimlet/WEB-INF/ and zimbra/WEB-INF/ subfolders.
cat /etc/audit/audit.rules:
## ...
- 241
0
votes
1
answer
140
views
Losing Audit Logs When Tracing a Container
As you know, Linux Audit is not installed on Ubuntu Focal by default. I installed it, and my goal is to trace what containers do. I have this seccomp profile:
{
"defaultAction": &...
- 1
0
votes
1
answer
853
views
CIS compliant auditd configuration on Red Hat 7/8
We have a large fleet of Red Hat 7/8 systems. We have a requirement to make sure that all systems are CIS compliant.
One of the requirement is to not automatically rotate the audit logs. That is, ...
- 91
1
vote
0
answers
158
views
auditd killing a server?
In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"):
...
audit: audit_backlog=32769 > audit_backlog_limit=...
- 51
1
vote
0
answers
693
views
stop kernel audit messages logged in syslog without disabling auditing
OS: CentOS 7
I am trying to figure out how audit (kaudit) events are logged in /var/log/messages.
I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
- 1,774
1
vote
1
answer
372
views
Auditd not sending logs to centralized auditd log server
We have set up centralized logging of auditd messages for two machines:
machine (www22.domain.com) is the source (centos8)
machine (cls.domain.com) is the centralized log server (centos7)
This was ...
- 282
2
votes
1
answer
3k
views
CentOS doesn't boot with "A stop job is running for Security Auditing Service" message
CentOS prints the following during boot
[ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s)
and then switches into the single user mode.
- 61
1
vote
1
answer
331
views
Log execve's, along with parent process argv?
I'm trying to figure out if I can decomission an old server. I need the information about automated processes running there. So far I tried the following:
auditctl -a exit,always -F arch=b64 -S ...
- 321
1
vote
0
answers
173
views
selinux - why can't stuff_u with sysadm_r run postsuper?
I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand.
According to redhat
SELinux User Capabilities
stuff_u users should be ...
- 21
1
vote
0
answers
201
views
Monitoring IPv6 connection via auditd
some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection
I'have found helpful article about that - Finding short-lived TCP ...
- 11
0
votes
1
answer
655
views
How to install `aide` without `aide-common` in debian?
Per this post,
Newer versions of Ubuntu (including 14.04) come with two packages for
AIDE:
aide, with the aide command and manual page, and little else
aide-common, with a wrapper around that ...
- 945
0
votes
1
answer
478
views
how send alert message from script to auditd.log?
Due to auditing policies ( auditd.log is monitored), I have to send alert messages from my adhoc check scripts to auditd.log.
Any idea what is best / standard solution ?
I think that echo log >>...
- 219
1
vote
2
answers
222
views
Issue with running Linux Audit System in a nested Virtual Machine inside Google Cloud Engine
I am trying to run the Linux audit system in a nested Virtual machine on the google cloud engine. The problem I am facing is that the Linux Audit System suspends after showing the following error ...
google-cloud-platform
1
vote
0
answers
156
views
CentOS USER_CMD logs auditd
We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it?
We already getting commands, starting with sudo, but not ...
1
vote
0
answers
263
views
Tracking TCP Connection in background
I am looking for a daemon utility to track all non local TCP connections and which binaries establish the TCP connections (actively and passively) with which IPs and ports.
auditd seems like a great ...
- 245
1
vote
0
answers
115
views
Filtering auditd log entries by msg content
I want to filter out this messages. They are generated by the user crontabs running every minute:
type=USER_END msg=audit(1611873842.675:459608): pid=19114 uid=0 auid=10061 ses=480462 subj==unconfined ...
- 11
0
votes
2
answers
551
views
selinux audit rule not logging anything
I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
0
votes
1
answer
521
views
Email alert when private keys read from disk (honeypot, auditd)
I'd like to receive an immediate alert every time something reads the contents of my private key on Debian Linux. How can I do that?
I have an RSA private key stored on my server's disk at the ...
- 759
1
vote
0
answers
228
views
Auditd to CloudwatchLogs to IDS alerts?
I'm administering a relatively simple AWS stack with about 5 heterogeneous Linux EC2 instances. All instances already have been setup to ship important logs to Cloudwatch Logs. Now I want to setup a ...
- 188
0
votes
0
answers
83
views
Auditd - track commands (regular and sudo) of a given UID
I have some auditd rules like:
-a always,exit -F arch=b32 -S execve -F euid=1002 -k mytag
-a always,exit -F arch=b64 -S execve -F euid=1002 -k mytag
-a always,exit -F arch=b32 -S execve -F euid=1003 -...
- 32
0
votes
0
answers
36
views
Is it possible to ensure detection and logging of all attempts to copy data out of a system?
Say I have a server set-up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive data out of the platform, but could in principle do so ...
- 111
0
votes
0
answers
933
views
How to get auditd started in CentOS Linux release 8.2.2004?
I did sudo yum reinstall audit on my server running CentOS Linux release 8.2.2004.
When I tried systemctl start auditd it failed. When I ran journalctl -xe I received the following output:
-- Unit ...
- 133
1
vote
1
answer
2k
views
RHEL: Splitting auditd logs into multiple files for different rules
We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance.
One problem we are having is that certain rules ...
- 151
0
votes
0
answers
202
views
Why does auditd report UID 1001 is trying to mount a disk when Ubuntu upon boot?
I'm seeing a message from auditd I don't understand. My OS is Ubuntu 20.04.
Every time I boot the server, an audit entry says user id 1001 (a normal user) is making a syscall to /usr/bin/mount. But ...
- 125
1
vote
1
answer
624
views
Auditd not sending to remote central server
I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server.
Note: instead of going to /etc/audisp/, these
...
- 13
0
votes
1
answer
2k
views
I am trying to setup some auditd rules but getting error -F missing operation for auid
i am trying to setup the below rule in /etc/audit/audit.rules
-a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete
which didn't work so i tried ...
user438713
0
votes
1
answer
1k
views
use linux auditd to log absolute everything
im trying to audit an automated task that connect to my server and exec some commands.
I would like to know everything it does.
Currently Im trying these rules at my audit.rules file.
-a exit,always -...
1
vote
1
answer
592
views
How can one identify what changes the SELinux file context of a file?
I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
- 151
0
votes
1
answer
42
views
Conflic install package solution?
I need to install auditd from package because my CentOS 6.6 server can't use yum update. But I got some problem and can't install them:
rpm -i audit-libs-2.4.5-6.el6.i686.rpm audit-2.4.5-6.el6.i686....
0
votes
1
answer
733
views
Auditing user activity when using SSH Certificates
I have been reading a lot lately on SSH Certificates and i love the advantages it brings.
Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
- 161
0
votes
1
answer
201
views
Logging changes to file change/modify attributes
System is Centos8
I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these ...
- 854
0
votes
2
answers
2k
views
Disable cron messages in auditd
I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS.
For example, even if my /etc/audit/audit.rules contains no rules:
-...
- 123
1
vote
0
answers
35
views
Ubuntu - Don't apply audit policy for specific process
I am using a 3rd party logging service (LogDNA) to centralise my server logs, but the agent installed on the server is actually causing the generation of additional and unnecessary logs.
My audit ...
0
votes
1
answer
318
views
How to configure auditd to collect logs from /proc kernel file directory
I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk.
To do this I need to be ...
1
vote
0
answers
2k
views
How can I control the audit backlog limit without the auditd package installed?
I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
- 11
1
vote
1
answer
1k
views
Configure auditd to monitor the execution of only one command
We have Ansible in place
I want to set up audit which logs who executes a play.. I want therefore only monitor the execution of the command ansible or ansible-playbook.
I can configure Ansible to ...
- 11
0
votes
1
answer
614
views
Connections shows up in tcpdump but cannot not in auditd or ss
I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections.
I ...
- 15
0
votes
1
answer
522
views
Debugging how symbolic link is getting broken in ubuntu?
I have a symbolic link of the form
ubuntu@platform1:~$ ls -lrt
total 28
drwxr-xr-x 4 ubuntu ubuntu 4096 Mar 2 15:02 deploy
lrwxrwxrwx 1 ubuntu ubuntu 14 May 25 18:27 logs -> /var/log/arkin
...
- 333