Questions tagged [auditd]
auditd is the userspace component to the Linux Auditing System.
1
vote
1answer
31 views
Permission denied when adding audit rule in audisp plugin
I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
0
votes
1answer
11 views
Name rotated auditd logs with date
Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have
audit.log
audit.log.1
audit.log.2
...
When audit.log fills up all of the files are rotated one number ...
1
vote
1answer
35 views
Audit file modifications over ssh in linux
I wanted to monitor all the modifications made to a file in a Linux server (Redhat). I made some research and found this auditing tool which I have already installed and configured using following ...
0
votes
1answer
90 views
auditlog filling up without any rules
I have set up certain audit rules however audit log is filling up with unnecessary events which I don't want to log. is there any way that auditd will log only defined rule-based logs.
OS: -Rhel 7.3
1
vote
2answers
76 views
How to determine process which makes DNS Request? [duplicate]
I have a server on AWS, GuardDuty started send me notifications:
*** "type":"Backdoor:EC2/C&CActivity.B!DNS",
*** {"domain":"libcurl.so","protocol":"UDP","blocked":false}
*** is querying a domain ...
0
votes
1answer
21 views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
1
vote
1answer
66 views
View auditd logs in journalctl
I'm using CentOS 7. trying to view auditd logs in journalctl
When I try journalctl -u auditd I see the following output:
-- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 ...
2
votes
3answers
58 views
Password change audit on solaris
Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts?
I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
60 views
ausearch to filter audit logs to show only read, write , attribute changes in file
I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit).
I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc.
...
0
votes
0answers
20 views
auditing a specific user activity in centos [duplicate]
I have created a user for a specific purpose and gave it to a team member. Now I want to keep track of all his executed commands (failed/successful).
I have added "auditctl -a exit,always -F auid=...
0
votes
0answers
168 views
How to view audit logs on the server
I'm trying to do a nfs share. I've configured the share.
Now I want to view the logs associated with the files in the nfs share.
I've created a centralized log server. I don't know the difference ...
0
votes
1answer
32 views
How to configure auditd to record all the activity from events which run with WinSCP
I have a requirement from a customer (I have no idea if it can be implemented, after days of searching). This is the request: "The auditlog rules should be extended for events (create, delete, update, ...
1
vote
1answer
446 views
Redirect Auditd.log data to rsyslog in RHEL-7
I would like to redirect the auditd log data into rsyslog instead of audit.log file.
I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to
...
0
votes
2answers
55 views
Linux SSH audit for failed root login
Let's assume there are two servers ( Server A and Server B ). I am seeing root ssh failed login attempted from Server A to Server B. ssh for root login has been disabled for both of the severs.
I ...
1
vote
0answers
73 views
auditctl doesn't stores reads
So I have this rule on auditctl:
-w /home/ec2-user/myfile -p rwa -k key-name
But when I run
ausearch -f /home/ec2-user/myfile
or check the logs in /var/log/audit/audit.log, I can't see any ...
1
vote
1answer
49 views
Can auditd logs be modified? (Security, shell monitoring)
I recently set up auditd and enabled TTY logging so I could give someone non-root shell access and monitor what they're doing. (For what it's worth I gave them jailshell access, a cPanel feature that ...
0
votes
0answers
21 views
Auditing file names containing spaces with auditd
In Ubuntu 14.04, auditing file names containing spaces with auditd, is this possible?
I tried
-w "/home/leroy/Technical information.odt" -k test
using auditctl and it was added.
However, putting ...
0
votes
0answers
39 views
Can auditd log events from an specific executable?
I'm trying to set up some rules in order to monitor certain FS in a Ubuntu server box, without SE Linux. So far I was able to exclude certain syscalls but that's not what I need, I'm looking forward ...
0
votes
0answers
89 views
Restart of auditd causes audispd reconfigure infinite loop
We restart some of our services on Debian jessie every night at 11:45 PM as part of logfile rotation. Among those services that we restart is the auditd service. We are sometimes seeing that audispd ...
1
vote
0answers
30 views
Ubuntu 14.04.5 Need To Know If/When auditd Stops/Crashes
I have a security requirement to take some action (halt or reboot to single user mode) when/if auditd stops or crashes. I have set up auditd.conf to handle running out of disk space. Somehow I don't ...
1
vote
0answers
141 views
Solaris 11 Auditing, audit_control file cannot be found
First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more.
From the ...
0
votes
1answer
22 views
auditd cache activity filtering?
Can anyone suggest a strategy for filtering browser cache activity from auditable events in CentOS6. Apparently el7 has added capabilities for filtering on executables? But all of our workstation ...
0
votes
1answer
57 views
auditctl: Error - nested rule files not supported
I'm trying to list the rules in a rules file using auditctl, whenever I do: auditctl -R audit.rules -l; I receive the error Error - nested rule files not supported. I've gone so far as to empty the ...
0
votes
0answers
52 views
Why do some System Call Audit Rules omit the -S Flag?
I've been tasked with adding some audit rules to our audit system, so I'm educating myself about the kernel audit system.
I'm currently learning how to read audit rules, and it looks like some of ...
0
votes
0answers
32 views
Changes made with chattr are not detected by auditd
I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using:
auditctl -w /etc/my_path_to_monitor -p wa -k my_rule
This works great for everything ...
0
votes
1answer
327 views
How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]
I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
0
votes
1answer
54 views
Why does auditd only log `echo` when I use the absolute path?
Info
Running auditd version 2.6.5 on Centos 7.
My rules file contains:
-a exit,always -F arch=b64 -F auid=0 -S execve -k root_action
-a exit,always -F arch=b32 -F auid=0 -S execve -k root_action
...
0
votes
0answers
36 views
Is there anyway to log all system calls with DTrace?
I installed DTrace on Ubuntu by the following command:
sudo apt-get install systemtap-sdt-dev
Is there anyway to log all system calls with DTrace (it is possible by auditd but it crashes after 20 ...
1
vote
1answer
2k views
Problems with auditd rules files
I have a problem generating auditd rules on CentOS 7.
I have 2 .rules files in my /etc/audit/rules.d/ directory. Both files are owned by root and only root has access. When I reload the rules using ...
0
votes
2answers
395 views
How to prevent logging USER_AUTH and USER_LOGIN events with auditd
I am trying to log changes to a file system using auditd, but I am seeing also many other things being logged, for example all failed SSH logging attempts (USER_AUTH and USER_LOGIN events). How can I ...
0
votes
0answers
519 views
Sending auditd logs to Splunk
Is it possible to send auditd logs from a server to Splunk, using audispd and its plugin audisp-remote?
I configured audispd and audisp-remote but it doesnt work, audispd doesn't send anything.My ...
0
votes
1answer
123 views
CentOS 7.3 audit2allow return “plural forms expression could be dangerous”
Hi I try to check audit2why or audit2allow but I get error:
cat /var/log/audit/audit.log | audit2why
plural forms expression could be dangerous
I have just installed latest CentOS from repos, using ...
2
votes
0answers
81 views
How do I audit cgroup changes
I have a container process that is mysteriously changing cgroups long after it has been started. How do I track down who/what is changing it? I tried watching my audit log when manually doing a ...
0
votes
1answer
160 views
auditd not logging file actions properly
I have a Linux machine where I have configured an audit rule for monitoring any types of changes on a file. This is the rule I placed in /etc/audit/audit.rules file:
-w /home/ec2-user/splunk-test/...
0
votes
1answer
772 views
suppress audit events from a specific user
I'm trying to track down the source cause of a breakin on a serverhosting customer's website.
auditd is a great help in showing me what directory to look in when yet another bit of malware (the site ...
2
votes
2answers
699 views
What's stopping auditd from logging writes by Syslog when watching a Syslog file?
We've recently started using auditd on one of our Ubuntu servers.
The example audit.rules file we were given has a rule like this:
-w /var/log/syslog -p wra -k logs
However, when syslog writes to ...
0
votes
0answers
332 views
How do I get auditd to show me the folder/file name of something it's monitoring, when the changes are made via an smb client?
I'm using auditd to audit a folder, /shared, for read, write, attribute changes and deletions.
I have installed auditd and configured the following rules:
-a exit,always -S unlink -S rmdir
-a exit,...
1
vote
0answers
62 views
Centos 7 auditing pipe-user-pages-soft being exceeded
The following patch introduced behaviour where a user has the default buffer size of new pipes changed if the total amount of memory used by pipes exceeds a threshold.
https://lkml.org/lkml/2016/1/18/...
1
vote
1answer
469 views
auditd doesn't log chmod at all
I run the following, with the idea that I want to log any changes to the permissions of the home/username directory:
auditctl -w /home/username -p a
Then I run the following:
tail -f /var/log/audit/...
1
vote
0answers
215 views
CoreOS logs flooded with “Unknown permission status for class system”
I am trying to debug an issue, and I was wondering if this rings a bell to anyone: My logs get flooded with
audit: type=1107 audit(1479418315.344:1053): pid=1 uid=0 auid=4294967295 ses=4294967295 ...
2
votes
0answers
374 views
Linux Auditd tracking writes on external media
So I've been looking at ways to audit when a form of external media performs writes/ uploads on a Linux system. Currently the main solution I have come across is to simply audit when the mount and ...
2
votes
2answers
3k views
What is the syslog facility for auditd logs?
Trying to forward only my auditd events by syslog, but I don't know which facility to use. I don't want to send everything to my syslog server as it would create redundancy in logging. I've set the ...
0
votes
1answer
227 views
Can aureport show filenames for read/write access reporting?
I installed auditd this evening in the hopes of using it to report on files written or appended to within a directory tree on my server. I have successfully configured rules using auditctl, but I ...
0
votes
1answer
77 views
Centos Audit.log is full of no relevant information
My audit.log file is full of information that i font need (and want to disable)
A lot of log lines like:
type=SYSCALL msg=audit(1467201475.671:36911834): arch=c000003e syscall=2 success=yes exit=49 ...
0
votes
1answer
1k views
Restarting audit on El Capitan
I want to monitor process startup on El Capitan.
Darwin MaeLucirdosiMac.home 15.5.0 Darwin Kernel Version 15.5.0: Tue Apr 19 18:36:36 PDT 2016; root:xnu-3248.50.21~8/RELEASE_X86_64 x86_64
Below is ...
0
votes
1answer
666 views
auditd - Getting only EXECVE in ausearch?
I'd like to use the auditd daemon to log whatever is run as or by root on our servers. To that effect, I added the following lines to /etc/audit/audit.rules:
# Log all commands run as (or by) root
-a ...
1
vote
0answers
117 views
How to record audit logs for only one specified file in FreeBSD?
On Red Hat Linux I can specify the file I want to record audit logs for with this command:
auditctl -a exit,always -F path=/tmp/foo.txt -F perm=war
I cannot figure out how to do a similar thing on ...
2
votes
2answers
1k views
How to tell if auditd has suspended logging?
If you put the following in your auditd.conf, auditd will suspend logging when you have 50MB or less space on your disk:
admin_space_left = 50
admin_space_left_action = SUSPEND
How can an external ...
5
votes
2answers
1k views
What does auditd log by default (i.e. when no rules are defined?)
I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example:
type=LOGIN msg=audit(...
0
votes
1answer
387 views
How can I process auditd logs on the fly using ausearch?
I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
