Questions tagged [auditd]

auditd is the userspace component to the Linux Auditing System.

Filter by
Sorted by
Tagged with
1 vote
0 answers
18 views

How to set proctitle to ascii in auditd?

I configured auditd to send the logs to SIEM through rsyslog. But when I get those logs the proctitle is in hex. Ex.: <134>Aug 25 17:08:44 vmauditd tag_audit_log: node=vmauditd type=PROCTITLE ...
Sandson Costa's user avatar
1 vote
1 answer
81 views

auditd.conf - when is "verify_email" actually checked?

When using an email address in /etc/audit/auditd.conf, there is an option verify_email which is defined as, This option determines if the email address given in action_mail_acct is checked to see if ...
J'e's user avatar
  • 83
0 votes
0 answers
518 views

Linux Auditd: Error receiving audit netlink packet (No buffer space available)

I have some Linux servers that are getting errors like the below in the logs... auditd[1074]: Error receiving audit netlink packet (No buffer space available) I know HOW to resolve the issue (tweak ...
Egyas's user avatar
  • 151
1 vote
1 answer
131 views

Audit log emails not going to the correct address

On Ubuntu 20, I'm trying to send audit logs to [email protected]. I do have a real domain and email server but I'm redacting them here. When I trigger an audit event, the email is instead sent ...
J'e's user avatar
  • 83
0 votes
0 answers
73 views

How to configure osquery with auditd

Who has expertise on how to work with osquery (or maybe you solved this problem): Based on articles like this one - https://blog.palantir.com/auditing-with-osquery-part-two-configuration-and-...
Nullbyte42's user avatar
1 vote
2 answers
187 views

What can you do when auditd halts the system?

I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again ...
Dave's user avatar
  • 111
1 vote
1 answer
106 views

Auditd - Don't log events from salt-minion

I'm updating our Auditd rules (Red Hat Linux) to log all tty/interactive commands from all users. That part works no problem. What I'm trying to do now is to exclude commands issued by our salt-...
Egyas's user avatar
  • 151
0 votes
1 answer
94 views

Audit Log Partition keeps getting corrupted. How to prevent or boot anyway?

I am running RHEL7, and my audit log partition randomly (not often, but often enough to annoy me) gets corrupted, preventing me from booting. How can I either prevent the partition from being ...
dberm22's user avatar
  • 61
1 vote
1 answer
304 views

Find process that makes outbound HTTP calls, trying auditd with syslog-ng

Some of application (it's unknown) makes sporadic nonregular rare short outbound HTTP(S) requests to a known host/port/url (this is a WAF honeypot, host/url/port is known) using HTTPS protocol. ...
lospejos's user avatar
  • 846
0 votes
0 answers
67 views

Why Firefox is trying to access .bashrc?

This Ubuntu 22.04 installation is fairly new. Why firefox is trying to read .bashrc and many other files. Does this indicate a security breach? [340664.822484] audit: type=1400 audit(1665738538.467:...
chrislamp's user avatar
0 votes
0 answers
134 views

Auditd service mysteriously stopped after 2 minutes on Ubuntu

ubuntu:~$ systemctl status auditd ● auditd.service - Security Auditing Service Loaded: loaded (/lib/systemd/system/auditd.service; enabled; vendor preset: enabled) Active: inactive (dead) since ...
q85ts's user avatar
  • 1
1 vote
0 answers
101 views

Linux Auditd monitoring of file operations in mounted folder

I have multi node kubernetes cluster and I would like to monitor file operations that are made by containers in mounted persistent volume. I found the all PV data are located at nodes in /var/lib/...
lukas.hubl's user avatar
1 vote
0 answers
387 views

auditd - dir cannot be used with exclude filter?

I have a problem with auditd rules. I'd like to audit /opt/zimbra/mailboxd/webapps/ dir but without: zimbraAdmin/WEB-INF/,zimlet/WEB-INF/ and zimbra/WEB-INF/ subfolders. cat /etc/audit/audit.rules: ## ...
XorOrNor's user avatar
  • 241
0 votes
1 answer
140 views

Losing Audit Logs When Tracing a Container

As you know, Linux Audit is not installed on Ubuntu Focal by default. I installed it, and my goal is to trace what containers do. I have this seccomp profile: { "defaultAction": &...
MoeKav's user avatar
  • 1
0 votes
1 answer
853 views

CIS compliant auditd configuration on Red Hat 7/8

We have a large fleet of Red Hat 7/8 systems. We have a requirement to make sure that all systems are CIS compliant. One of the requirement is to not automatically rotate the audit logs. That is, ...
Jigar's user avatar
  • 91
1 vote
0 answers
158 views

auditd killing a server?

In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"): ... audit: audit_backlog=32769 > audit_backlog_limit=...
jim7475's user avatar
  • 51
1 vote
0 answers
693 views

stop kernel audit messages logged in syslog without disabling auditing

OS: CentOS 7 I am trying to figure out how audit (kaudit) events are logged in /var/log/messages. I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
giomanda's user avatar
  • 1,774
1 vote
1 answer
372 views

Auditd not sending logs to centralized auditd log server

We have set up centralized logging of auditd messages for two machines: machine (www22.domain.com) is the source (centos8) machine (cls.domain.com) is the centralized log server (centos7) This was ...
Ján Lalinský's user avatar
2 votes
1 answer
3k views

CentOS doesn't boot with "A stop job is running for Security Auditing Service" message

CentOS prints the following during boot [ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s) and then switches into the single user mode.
McLayn's user avatar
  • 61
1 vote
1 answer
331 views

Log execve's, along with parent process argv?

I'm trying to figure out if I can decomission an old server. I need the information about automated processes running there. So far I tried the following: auditctl -a exit,always -F arch=b64 -S ...
d33tah's user avatar
  • 321
1 vote
0 answers
173 views

selinux - why can't stuff_u with sysadm_r run postsuper?

I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand. According to redhat SELinux User Capabilities stuff_u users should be ...
Jose's user avatar
  • 21
1 vote
0 answers
201 views

Monitoring IPv6 connection via auditd

some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection I'have found helpful article about that - Finding short-lived TCP ...
Bormental's user avatar
0 votes
1 answer
655 views

How to install `aide` without `aide-common` in debian?

Per this post, Newer versions of Ubuntu (including 14.04) come with two packages for AIDE: aide, with the aide command and manual page, and little else aide-common, with a wrapper around that ...
kittygirl's user avatar
  • 945
0 votes
1 answer
478 views

how send alert message from script to auditd.log?

Due to auditing policies ( auditd.log is monitored), I have to send alert messages from my adhoc check scripts to auditd.log. Any idea what is best / standard solution ? I think that echo log >>...
andrew's user avatar
  • 219
1 vote
2 answers
222 views

Issue with running Linux Audit System in a nested Virtual Machine inside Google Cloud Engine

I am trying to run the Linux audit system in a nested Virtual machine on the google cloud engine. The problem I am facing is that the Linux Audit System suspends after showing the following error ...
punnal baloch's user avatar
1 vote
0 answers
156 views

CentOS USER_CMD logs auditd

We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it? We already getting commands, starting with sudo, but not ...
Valeriy Soloninka's user avatar
1 vote
0 answers
263 views

Tracking TCP Connection in background

I am looking for a daemon utility to track all non local TCP connections and which binaries establish the TCP connections (actively and passively) with which IPs and ports. auditd seems like a great ...
HCSF's user avatar
  • 245
1 vote
0 answers
115 views

Filtering auditd log entries by msg content

I want to filter out this messages. They are generated by the user crontabs running every minute: type=USER_END msg=audit(1611873842.675:459608): pid=19114 uid=0 auid=10061 ses=480462 subj==unconfined ...
Pyloor's user avatar
  • 11
0 votes
2 answers
551 views

selinux audit rule not logging anything

I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
RedTedRedemption's user avatar
0 votes
1 answer
521 views

Email alert when private keys read from disk (honeypot, auditd)

I'd like to receive an immediate alert every time something reads the contents of my private key on Debian Linux. How can I do that? I have an RSA private key stored on my server's disk at the ...
Michael Altfield's user avatar
1 vote
0 answers
228 views

Auditd to CloudwatchLogs to IDS alerts?

I'm administering a relatively simple AWS stack with about 5 heterogeneous Linux EC2 instances. All instances already have been setup to ship important logs to Cloudwatch Logs. Now I want to setup a ...
spinkus's user avatar
  • 188
0 votes
0 answers
83 views

Auditd - track commands (regular and sudo) of a given UID

I have some auditd rules like: -a always,exit -F arch=b32 -S execve -F euid=1002 -k mytag -a always,exit -F arch=b64 -S execve -F euid=1002 -k mytag -a always,exit -F arch=b32 -S execve -F euid=1003 -...
Ani's user avatar
  • 32
0 votes
0 answers
36 views

Is it possible to ensure detection and logging of all attempts to copy data out of a system?

Say I have a server set-up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive data out of the platform, but could in principle do so ...
Thomas Arildsen's user avatar
0 votes
0 answers
933 views

How to get auditd started in CentOS Linux release 8.2.2004?

I did sudo yum reinstall audit on my server running CentOS Linux release 8.2.2004. When I tried systemctl start auditd it failed. When I ran journalctl -xe I received the following output: -- Unit ...
Nona's user avatar
  • 133
1 vote
1 answer
2k views

RHEL: Splitting auditd logs into multiple files for different rules

We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance. One problem we are having is that certain rules ...
JD D's user avatar
  • 151
0 votes
0 answers
202 views

Why does auditd report UID 1001 is trying to mount a disk when Ubuntu upon boot?

I'm seeing a message from auditd I don't understand. My OS is Ubuntu 20.04. Every time I boot the server, an audit entry says user id 1001 (a normal user) is making a syscall to /usr/bin/mount. But ...
user450409's user avatar
1 vote
1 answer
624 views

Auditd not sending to remote central server

I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server. Note: instead of going to /etc/audisp/, these ...
Gwynn's user avatar
  • 13
0 votes
1 answer
2k views

I am trying to setup some auditd rules but getting error -F missing operation for auid

i am trying to setup the below rule in /etc/audit/audit.rules -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete which didn't work so i tried ...
user avatar
0 votes
1 answer
1k views

use linux auditd to log absolute everything

im trying to audit an automated task that connect to my server and exec some commands. I would like to know everything it does. Currently Im trying these rules at my audit.rules file. -a exit,always -...
user2977753's user avatar
1 vote
1 answer
592 views

How can one identify what changes the SELinux file context of a file?

I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
TopherIsSwell's user avatar
0 votes
1 answer
42 views

Conflic install package solution?

I need to install auditd from package because my CentOS 6.6 server can't use yum update. But I got some problem and can't install them: rpm -i audit-libs-2.4.5-6.el6.i686.rpm audit-2.4.5-6.el6.i686....
mtpumpkin's user avatar
0 votes
1 answer
733 views

Auditing user activity when using SSH Certificates

I have been reading a lot lately on SSH Certificates and i love the advantages it brings. Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
cybervedaa's user avatar
0 votes
1 answer
201 views

Logging changes to file change/modify attributes

System is Centos8 I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these ...
Ex Umbris's user avatar
  • 854
0 votes
2 answers
2k views

Disable cron messages in auditd

I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS. For example, even if my /etc/audit/audit.rules contains no rules: -...
1nsane's user avatar
  • 123
1 vote
0 answers
35 views

Ubuntu - Don't apply audit policy for specific process

I am using a 3rd party logging service (LogDNA) to centralise my server logs, but the agent installed on the server is actually causing the generation of additional and unnecessary logs. My audit ...
Alex Currie-Clark's user avatar
0 votes
1 answer
318 views

How to configure auditd to collect logs from /proc kernel file directory

I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk. To do this I need to be ...
Geordeaux's user avatar
1 vote
0 answers
2k views

How can I control the audit backlog limit without the auditd package installed?

I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
Craig M's user avatar
  • 11
1 vote
1 answer
1k views

Configure auditd to monitor the execution of only one command

We have Ansible in place I want to set up audit which logs who executes a play.. I want therefore only monitor the execution of the command ansible or ansible-playbook. I can configure Ansible to ...
zn553's user avatar
  • 11
0 votes
1 answer
614 views

Connections shows up in tcpdump but cannot not in auditd or ss

I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections. I ...
kjq07bd's user avatar
  • 15
0 votes
1 answer
522 views

Debugging how symbolic link is getting broken in ubuntu?

I have a symbolic link of the form ubuntu@platform1:~$ ls -lrt total 28 drwxr-xr-x 4 ubuntu ubuntu 4096 Mar 2 15:02 deploy lrwxrwxrwx 1 ubuntu ubuntu 14 May 25 18:27 logs -> /var/log/arkin ...
tuk's user avatar
  • 333