Questions tagged [auditd]
auditd is the userspace component to the Linux Auditing System.
150
questions
0
votes
1
answer
28
views
CIS compliant auditd configuration on Red Hat 7/8
We have a large fleet of Red Hat 7/8 systems. We have a requirement to make sure that all systems are CIS compliant.
One of the requirement is to not automatically rotate the audit logs. That is, ...
- 61
1
vote
0
answers
38
views
auditd killing a server?
In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"):
...
audit: audit_backlog=32769 > audit_backlog_limit=...
- 21
0
votes
0
answers
33
views
Logging user creation and deletion with auditd
What is the best way to log/detect user creation on linux machines by using auditd?
I was thinking about logging calls to /usr/bin/ and /usr/sbin/ and filtering out useradd, adduser, deluser and ...
- 103
1
vote
0
answers
56
views
stop kernel audit messages logged in syslog without disabling auditing
OS: CentOS 7
I am trying to figure out how audit (kaudit) events are logged in /var/log/messages.
I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
- 1,595
1
vote
1
answer
117
views
Auditd not sending logs to centralized auditd log server
We have set up centralized logging of auditd messages for two machines:
machine (www22.domain.com) is the source (centos8)
machine (cls.domain.com) is the centralized log server (centos7)
This was ...
- 262
1
vote
1
answer
1k
views
CentOS doesn't boot with "A stop job is running for Security Auditing Service" message
CentOS prints the following during boot
[ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s)
and then switches into the single user mode.
- 41
1
vote
1
answer
48
views
Log execve's, along with parent process argv?
I'm trying to figure out if I can decomission an old server. I need the information about automated processes running there. So far I tried the following:
auditctl -a exit,always -F arch=b64 -S ...
- 302
1
vote
0
answers
94
views
selinux - why can't stuff_u with sysadm_r run postsuper?
I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand.
According to redhat
SELinux User Capabilities
stuff_u users should be ...
- 11
1
vote
0
answers
84
views
Monitoring IPv6 connection via auditd
some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection
I'have found helpful article about that - Finding short-lived TCP ...
- 11
0
votes
0
answers
30
views
why auditd not monitor/report adhoc log file?
I tried to watch my adhoc alert.log file with auditd, but I don't know why it does not work.
I found no related entries in the auditd.log file.
# auditctl -w /tmp/alert1.log -p wa -k alert
#
# ...
- 115
0
votes
1
answer
261
views
How to install `aide` without `aide-common` in debian?
Per this post,
Newer versions of Ubuntu (including 14.04) come with two packages for
AIDE:
aide, with the aide command and manual page, and little else
aide-common, with a wrapper around that ...
- 825
0
votes
0
answers
20
views
Troubleshooting auditd rules
I'm running RHEL 7.x. We have recently installed the DISA recommended rules for auditd.
Since we've installed these new audit rules, we've noticed a significant decrease in system performance.
Ex:
...
- 227
0
votes
1
answer
92
views
how send alert message from script to auditd.log?
Due to auditing policies ( auditd.log is monitored), I have to send alert messages from my adhoc check scripts to auditd.log.
Any idea what is best / standard solution ?
I think that echo log >>...
- 115
1
vote
2
answers
112
views
Issue with running Linux Audit System in a nested Virtual Machine inside Google Cloud Engine
I am trying to run the Linux audit system in a nested Virtual machine on the google cloud engine. The problem I am facing is that the Linux Audit System suspends after showing the following error ...
google-cloud-platform
1
vote
0
answers
71
views
CentOS USER_CMD logs auditd
We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it?
We already getting commands, starting with sudo, but not ...
1
vote
0
answers
60
views
Tracking TCP Connection in background
I am looking for a daemon utility to track all non local TCP connections and which binaries establish the TCP connections (actively and passively) with which IPs and ports.
auditd seems like a great ...
- 235
1
vote
0
answers
73
views
Filtering auditd log entries by msg content
I want to filter out this messages. They are generated by the user crontabs running every minute:
type=USER_END msg=audit(1611873842.675:459608): pid=19114 uid=0 auid=10061 ses=480462 subj==unconfined ...
- 11
0
votes
1
answer
70
views
selinux audit rule not logging anything
I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
-1
votes
1
answer
167
views
Email alert when private keys read from disk (honeypot, auditd)
I'd like to receive an immediate alert every time something reads the contents of my private key on Debian Linux. How can I do that?
I have an RSA private key stored on my server's disk at the ...
- 465
1
vote
0
answers
164
views
Auditd to CloudwatchLogs to IDS alerts?
I'm administering a relatively simple AWS stack with about 5 heterogeneous Linux EC2 instances. All instances already have been setup to ship important logs to Cloudwatch Logs. Now I want to setup a ...
- 158
0
votes
0
answers
28
views
Auditd - track commands (regular and sudo) of a given UID
I have some auditd rules like:
-a always,exit -F arch=b32 -S execve -F euid=1002 -k mytag
-a always,exit -F arch=b64 -S execve -F euid=1002 -k mytag
-a always,exit -F arch=b32 -S execve -F euid=1003 -...
- 32
0
votes
0
answers
29
views
Is it possible to ensure detection and logging of all attempts to copy data out of a system?
Say I have a server set-up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive data out of the platform, but could in principle do so ...
- 111
0
votes
0
answers
624
views
How to get auditd started in CentOS Linux release 8.2.2004?
I did sudo yum reinstall audit on my server running CentOS Linux release 8.2.2004.
When I tried systemctl start auditd it failed. When I ran journalctl -xe I received the following output:
-- Unit ...
- 123
1
vote
1
answer
1k
views
RHEL: Splitting auditd logs into multiple files for different rules
We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance.
One problem we are having is that certain rules ...
- 151
0
votes
0
answers
118
views
Why does auditd report UID 1001 is trying to mount a disk when Ubuntu upon boot?
I'm seeing a message from auditd I don't understand. My OS is Ubuntu 20.04.
Every time I boot the server, an audit entry says user id 1001 (a normal user) is making a syscall to /usr/bin/mount. But ...
- 105
0
votes
1
answer
209
views
Auditd not sending to remote central server
I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server.
Note: instead of going to /etc/audisp/, these
...
- 3
0
votes
1
answer
1k
views
I am trying to setup some auditd rules but getting error -F missing operation for auid
i am trying to setup the below rule in /etc/audit/audit.rules
-a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete
which didn't work so i tried ...
user438713
0
votes
1
answer
384
views
use linux auditd to log absolute everything
im trying to audit an automated task that connect to my server and exec some commands.
I would like to know everything it does.
Currently Im trying these rules at my audit.rules file.
-a exit,always -...
1
vote
1
answer
221
views
How can one identify what changes the SELinux file context of a file?
I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
- 111
0
votes
1
answer
27
views
Conflic install package solution?
I need to install auditd from package because my CentOS 6.6 server can't use yum update. But I got some problem and can't install them:
rpm -i audit-libs-2.4.5-6.el6.i686.rpm audit-2.4.5-6.el6.i686....
0
votes
1
answer
405
views
Auditing user activity when using SSH Certificates
I have been reading a lot lately on SSH Certificates and i love the advantages it brings.
Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
- 161
0
votes
1
answer
46
views
Logging changes to file change/modify attributes
System is Centos8
I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these ...
- 774
0
votes
2
answers
921
views
Disable cron messages in auditd
I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS.
For example, even if my /etc/audit/audit.rules contains no rules:
-...
- 123
1
vote
0
answers
26
views
Ubuntu - Don't apply audit policy for specific process
I am using a 3rd party logging service (LogDNA) to centralise my server logs, but the agent installed on the server is actually causing the generation of additional and unnecessary logs.
My audit ...
0
votes
1
answer
193
views
How to configure auditd to collect logs from /proc kernel file directory
I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk.
To do this I need to be ...
1
vote
0
answers
1k
views
How can I control the audit backlog limit without the auditd package installed?
I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
- 11
1
vote
1
answer
874
views
Configure auditd to monitor the execution of only one command
We have Ansible in place
I want to set up audit which logs who executes a play.. I want therefore only monitor the execution of the command ansible or ansible-playbook.
I can configure Ansible to ...
- 11
0
votes
1
answer
256
views
Connections shows up in tcpdump but cannot not in auditd or ss
I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections.
I ...
- 15
0
votes
1
answer
358
views
Debugging how symbolic link is getting broken in ubuntu?
I have a symbolic link of the form
ubuntu@platform1:~$ ls -lrt
total 28
drwxr-xr-x 4 ubuntu ubuntu 4096 Mar 2 15:02 deploy
lrwxrwxrwx 1 ubuntu ubuntu 14 May 25 18:27 logs -> /var/log/arkin
...
- 295
0
votes
1
answer
1k
views
Auditd Log all executions except some scripts
I configured my auditd to log all execve syscalls using these rules:
-a exit,always -F arch=b32 -S execve
-a exit,always -F arch=b64 -S execve
While this perfectly captures all activity of any user ...
- 3
5
votes
1
answer
7k
views
What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?
My server is centos7.6 with auditd 2.8.5
In audit rule, I set:
-a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change
But this rule also record normal ntpd activities,then I tried ...
- 825
0
votes
1
answer
926
views
How can `auditd` log in `/var/log/audit/audit.log` even `auditctl -l` is empty?
My server is centos7.6
[root@localhost /]# auditctl -l
No rules
[root@localhost /]# cat /var/log/audit/audit.log
type=CRED_REFR msg=audit(1552434501.528:25860): pid=12659 uid=0 auid=0 ses=3578 msg='...
- 825
0
votes
0
answers
662
views
Trying to enable auditd but svcadm not in solaris 10
I am new to Solaris.
environment: Solaris 10/ i386
Here's my problem:
I want to enable auditd to start generating system auditing log file. (Like service aduitd start in CentOS.)
And every guide I ...
- 1
4
votes
2
answers
1k
views
Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)
My auditd rules and my needs are fairly simple, I want only to log root actions.
# auditctl -l
-a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION
That is the only rule, and it works:
type=...
- 265
1
vote
0
answers
767
views
Auditd how to exclude everything
I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant.
-a never,exclude -F msgtype=CWD
-a ...
- 31
2
votes
0
answers
990
views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
- 357
0
votes
1
answer
697
views
Record ssh REMOTE_USER in audit or history logs
In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys.
Now, quite a few people work on those servers and sometimes we need to ...
- 133
1
vote
1
answer
241
views
Permission denied when adding audit rule in audisp plugin
I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
- 21
2
votes
1
answer
2k
views
Name rotated auditd logs with date
Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have
audit.log
audit.log.1
audit.log.2
...
When audit.log fills up all of the files are rotated one number ...
- 1,033
1
vote
1
answer
171
views
Audit file modifications over ssh in linux
I wanted to monitor all the modifications made to a file in a Linux server (Redhat). I made some research and found this auditing tool which I have already installed and configured using following ...
