Questions tagged [auditd]

auditd is the userspace component to the Linux Auditing System.

Filter by
Sorted by
Tagged with
0 votes
0 answers
61 views

How to identify which process made dns query for a particular host?

I can get logs for dns query made to a particular nameserver by auditd, but how can I get process which made dns query for a host.
SUNITA GUPTA's user avatar
0 votes
0 answers
190 views

SELinux silently blocking PHP process listing

I have a system where we use PHP to run some rudimentary health checks on the server. When hitting a status page, it verifies that certain processes are running, and returns an error message if ...
Jared's user avatar
  • 383
1 vote
0 answers
181 views

How to set proctitle to ascii in auditd?

I configured auditd to send the logs to SIEM through rsyslog. But when I get those logs the proctitle is in hex. Ex.: <134>Aug 25 17:08:44 vmauditd tag_audit_log: node=vmauditd type=PROCTITLE ...
Sandson Costa's user avatar
1 vote
1 answer
111 views

auditd.conf - when is "verify_email" actually checked?

When using an email address in /etc/audit/auditd.conf, there is an option verify_email which is defined as, This option determines if the email address given in action_mail_acct is checked to see if ...
J'e's user avatar
  • 83
0 votes
1 answer
3k views

Linux Auditd: Error receiving audit netlink packet (No buffer space available)

I have some Linux servers that are getting errors like the below in the logs... auditd[1074]: Error receiving audit netlink packet (No buffer space available) I know HOW to resolve the issue (tweak ...
Egyas's user avatar
  • 165
1 vote
1 answer
355 views

Audit log emails not going to the correct address

On Ubuntu 20, I'm trying to send audit logs to [email protected]. I do have a real domain and email server but I'm redacting them here. When I trigger an audit event, the email is instead sent ...
J'e's user avatar
  • 83
0 votes
0 answers
132 views

How to configure osquery with auditd

Who has expertise on how to work with osquery (or maybe you solved this problem): Based on articles like this one - https://blog.palantir.com/auditing-with-osquery-part-two-configuration-and-...
Nullbyte42's user avatar
1 vote
2 answers
618 views

What can you do when auditd halts the system?

I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again ...
Dave's user avatar
  • 111
1 vote
1 answer
143 views

Auditd - Don't log events from salt-minion

I'm updating our Auditd rules (Red Hat Linux) to log all tty/interactive commands from all users. That part works no problem. What I'm trying to do now is to exclude commands issued by our salt-...
Egyas's user avatar
  • 165
0 votes
1 answer
177 views

Audit Log Partition keeps getting corrupted. How to prevent or boot anyway?

I am running RHEL7, and my audit log partition randomly (not often, but often enough to annoy me) gets corrupted, preventing me from booting. How can I either prevent the partition from being ...
dberm22's user avatar
  • 61
1 vote
1 answer
556 views

Find process that makes outbound HTTP calls, trying auditd with syslog-ng

Some of application (it's unknown) makes sporadic nonregular rare short outbound HTTP(S) requests to a known host/port/url (this is a WAF honeypot, host/url/port is known) using HTTPS protocol. ...
lospejos's user avatar
  • 906
0 votes
0 answers
92 views

Why Firefox is trying to access .bashrc?

This Ubuntu 22.04 installation is fairly new. Why firefox is trying to read .bashrc and many other files. Does this indicate a security breach? [340664.822484] audit: type=1400 audit(1665738538.467:...
chrislamp's user avatar
1 vote
0 answers
134 views

Linux Auditd monitoring of file operations in mounted folder

I have multi node kubernetes cluster and I would like to monitor file operations that are made by containers in mounted persistent volume. I found the all PV data are located at nodes in /var/lib/...
lukas.hubl's user avatar
1 vote
0 answers
541 views

auditd - dir cannot be used with exclude filter?

I have a problem with auditd rules. I'd like to audit /opt/zimbra/mailboxd/webapps/ dir but without: zimbraAdmin/WEB-INF/,zimlet/WEB-INF/ and zimbra/WEB-INF/ subfolders. cat /etc/audit/audit.rules: ## ...
XorOrNor's user avatar
  • 241
0 votes
1 answer
203 views

Losing Audit Logs When Tracing a Container

As you know, Linux Audit is not installed on Ubuntu Focal by default. I installed it, and my goal is to trace what containers do. I have this seccomp profile: { "defaultAction": &...
MoeKav's user avatar
  • 1
0 votes
1 answer
1k views

CIS compliant auditd configuration on Red Hat 7/8

We have a large fleet of Red Hat 7/8 systems. We have a requirement to make sure that all systems are CIS compliant. One of the requirement is to not automatically rotate the audit logs. That is, ...
Jigar's user avatar
  • 101
1 vote
0 answers
200 views

auditd killing a server?

In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"): ... audit: audit_backlog=32769 > audit_backlog_limit=...
jim7475's user avatar
  • 51
1 vote
0 answers
945 views

stop kernel audit messages logged in syslog without disabling auditing

OS: CentOS 7 I am trying to figure out how audit (kaudit) events are logged in /var/log/messages. I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
giomanda's user avatar
  • 1,824
1 vote
1 answer
458 views

Auditd not sending logs to centralized auditd log server

We have set up centralized logging of auditd messages for two machines: machine (www22.domain.com) is the source (centos8) machine (cls.domain.com) is the centralized log server (centos7) This was ...
Ján Lalinský's user avatar
2 votes
1 answer
3k views

CentOS doesn't boot with "A stop job is running for Security Auditing Service" message

CentOS prints the following during boot [ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s) and then switches into the single user mode.
McLayn's user avatar
  • 193
1 vote
1 answer
430 views

Log execve's, along with parent process argv?

I'm trying to figure out if I can decomission an old server. I need the information about automated processes running there. So far I tried the following: auditctl -a exit,always -F arch=b64 -S ...
d33tah's user avatar
  • 321
1 vote
0 answers
203 views

selinux - why can't stuff_u with sysadm_r run postsuper?

I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand. According to redhat SELinux User Capabilities stuff_u users should be ...
Jose's user avatar
  • 21
1 vote
0 answers
239 views

Monitoring IPv6 connection via auditd

some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection I'have found helpful article about that - Finding short-lived TCP ...
Bormental's user avatar
0 votes
1 answer
842 views

How to install `aide` without `aide-common` in debian?

Per this post, Newer versions of Ubuntu (including 14.04) come with two packages for AIDE: aide, with the aide command and manual page, and little else aide-common, with a wrapper around that ...
kittygirl's user avatar
  • 965
0 votes
1 answer
589 views

how send alert message from script to auditd.log?

Due to auditing policies ( auditd.log is monitored), I have to send alert messages from my adhoc check scripts to auditd.log. Any idea what is best / standard solution ? I think that echo log >>...
andrew's user avatar
  • 229
1 vote
2 answers
261 views

Issue with running Linux Audit System in a nested Virtual Machine inside Google Cloud Engine

I am trying to run the Linux audit system in a nested Virtual machine on the google cloud engine. The problem I am facing is that the Linux Audit System suspends after showing the following error ...
punnal baloch's user avatar
1 vote
0 answers
193 views

CentOS USER_CMD logs auditd

We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it? We already getting commands, starting with sudo, but not ...
Valeriy Soloninka's user avatar
1 vote
0 answers
308 views

Tracking TCP Connection in background

I am looking for a daemon utility to track all non local TCP connections and which binaries establish the TCP connections (actively and passively) with which IPs and ports. auditd seems like a great ...
HCSF's user avatar
  • 245
1 vote
0 answers
145 views

Filtering auditd log entries by msg content

I want to filter out this messages. They are generated by the user crontabs running every minute: type=USER_END msg=audit(1611873842.675:459608): pid=19114 uid=0 auid=10061 ses=480462 subj==unconfined ...
Pyloor's user avatar
  • 11
0 votes
2 answers
824 views

selinux audit rule not logging anything

I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
RedTedRedemption's user avatar
0 votes
1 answer
605 views

Email alert when private keys read from disk (honeypot, auditd)

I'd like to receive an immediate alert every time something reads the contents of my private key on Debian Linux. How can I do that? I have an RSA private key stored on my server's disk at the ...
Michael Altfield's user avatar
1 vote
0 answers
254 views

Auditd to CloudwatchLogs to IDS alerts?

I'm administering a relatively simple AWS stack with about 5 heterogeneous Linux EC2 instances. All instances already have been setup to ship important logs to Cloudwatch Logs. Now I want to setup a ...
spinkus's user avatar
  • 207
0 votes
0 answers
117 views

Auditd - track commands (regular and sudo) of a given UID

I have some auditd rules like: -a always,exit -F arch=b32 -S execve -F euid=1002 -k mytag -a always,exit -F arch=b64 -S execve -F euid=1002 -k mytag -a always,exit -F arch=b32 -S execve -F euid=1003 -...
Ani's user avatar
  • 32
0 votes
0 answers
39 views

Is it possible to ensure detection and logging of all attempts to copy data out of a system?

Say I have a server set-up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive data out of the platform, but could in principle do so ...
Thomas Arildsen's user avatar
0 votes
0 answers
1k views

How to get auditd started in CentOS Linux release 8.2.2004?

I did sudo yum reinstall audit on my server running CentOS Linux release 8.2.2004. When I tried systemctl start auditd it failed. When I ran journalctl -xe I received the following output: -- Unit ...
Nona's user avatar
  • 143
1 vote
1 answer
2k views

RHEL: Splitting auditd logs into multiple files for different rules

We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance. One problem we are having is that certain rules ...
JD D's user avatar
  • 151
0 votes
0 answers
225 views

Why does auditd report UID 1001 is trying to mount a disk when Ubuntu upon boot?

I'm seeing a message from auditd I don't understand. My OS is Ubuntu 20.04. Every time I boot the server, an audit entry says user id 1001 (a normal user) is making a syscall to /usr/bin/mount. But ...
user450409's user avatar
1 vote
1 answer
831 views

Auditd not sending to remote central server

I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server. Note: instead of going to /etc/audisp/, these ...
Gwynn's user avatar
  • 13
0 votes
1 answer
2k views

I am trying to setup some auditd rules but getting error -F missing operation for auid

i am trying to setup the below rule in /etc/audit/audit.rules -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete which didn't work so i tried ...
user avatar
0 votes
1 answer
1k views

use linux auditd to log absolute everything

im trying to audit an automated task that connect to my server and exec some commands. I would like to know everything it does. Currently Im trying these rules at my audit.rules file. -a exit,always -...
user2977753's user avatar
1 vote
1 answer
783 views

How can one identify what changes the SELinux file context of a file?

I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
TopherIsSwell's user avatar
0 votes
1 answer
50 views

Conflic install package solution?

I need to install auditd from package because my CentOS 6.6 server can't use yum update. But I got some problem and can't install them: rpm -i audit-libs-2.4.5-6.el6.i686.rpm audit-2.4.5-6.el6.i686....
mtpumpkin's user avatar
0 votes
1 answer
927 views

Auditing user activity when using SSH Certificates

I have been reading a lot lately on SSH Certificates and i love the advantages it brings. Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
cybervedaa's user avatar
0 votes
1 answer
323 views

Logging changes to file change/modify attributes

System is Centos8 I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these ...
Ex Umbris's user avatar
  • 854
0 votes
2 answers
2k views

Disable cron messages in auditd

I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS. For example, even if my /etc/audit/audit.rules contains no rules: -...
1nsane's user avatar
  • 123
1 vote
0 answers
39 views

Ubuntu - Don't apply audit policy for specific process

I am using a 3rd party logging service (LogDNA) to centralise my server logs, but the agent installed on the server is actually causing the generation of additional and unnecessary logs. My audit ...
Alex Currie-Clark's user avatar
0 votes
1 answer
377 views

How to configure auditd to collect logs from /proc kernel file directory

I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk. To do this I need to be ...
Geordeaux's user avatar
1 vote
0 answers
2k views

How can I control the audit backlog limit without the auditd package installed?

I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
Craig M's user avatar
  • 11
1 vote
1 answer
2k views

Configure auditd to monitor the execution of only one command

We have Ansible in place I want to set up audit which logs who executes a play.. I want therefore only monitor the execution of the command ansible or ansible-playbook. I can configure Ansible to ...
zn553's user avatar
  • 11
0 votes
1 answer
710 views

Connections shows up in tcpdump but cannot not in auditd or ss

I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections. I ...
kjq07bd's user avatar
  • 15