Auditd : Search Logs with ausearch2023/07/13 |
|
Some Audit rules are set by default like System Login, Modification of User Accounts,
Sudo Actions and so on, there logs are recorded in [/var/log/audit/audit.log].
|
|
| [1] | The logs are text format, so it's possible to see logs directly. |
|
root@dlp:~# tail -5 /var/log/audit/audit.log type=SERVICE_START msg=audit(1689213483.695:51): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=user@0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=USER_START msg=audit(1689213483.695:52): pid=527 uid=0 auid=0 ses=1 subj=unconfined msg='op=PAM:session_open grantors=pam_selinux,pam_loginuid,pam_selinux,pam_env,pam_env,pam_limits,pam_lastlog,pam_mail,pam_keyinit,pam_permit,pam_unix,pam_systemd acct="root" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success'UID="root" AUID="root" type=CRED_ACQ msg=audit(1689213483.695:53): pid=527 uid=0 auid=0 ses=1 subj=unconfined msg='op=PAM:setcred grantors=pam_permit acct="root" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success'UID="root" AUID="root" type=USER_LOGIN msg=audit(1689213483.695:54): pid=527 uid=0 auid=0 ses=1 subj=unconfined msg='op=login acct="root" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success'UID="root" AUID="root" type=SERVICE_STOP msg=audit(1689213485.975:55): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=systemd-fsckd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" |
| [2] | Many logs are recorded in [audit.log] and they are complicated, so [ausearch] command is provided by Audit package to search specific logs. |
|
# search USER_LOGIN related logs root@dlp:~# ausearch --message USER_LOGIN --interpret ---- type=USER_LOGIN msg=audit(07/12/2023 20:57:59.999:38) : pid=527 uid=root auid=unset ses=unset subj=unconfined msg='op=login acct=root exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- type=USER_LOGIN msg=audit(07/12/2023 20:58:03.695:54) : pid=527 uid=root auid=root ses=1 subj=unconfined msg='op=login acct=root exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- type=USER_LOGIN msg=audit(07/12/2023 20:59:04.546:72) : pid=553 uid=root auid=debian ses=3 subj=unconfined msg='op=login acct=debian exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ..... ..... # search sudo actions by userID 1000 root@dlp:~# ausearch -x sudo -ua 1000 ---- time->Wed Jul 12 20:59:51 2023 type=USER_AUTH msg=audit(1689213591.646:81): pid=577 uid=1000 auid=1000 ses=3 subj=unconfined msg='op=PAM:authentication grantors=pam_permit acct="debian" exe="/usr/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Wed Jul 12 20:59:51 2023 type=USER_ACCT msg=audit(1689213591.646:82): pid=577 uid=1000 auid=1000 ses=3 subj=unconfined msg='op=PAM:accounting grantors=pam_permit acct="debian" exe="/usr/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Wed Jul 12 20:59:51 2023 type=USER_CMD msg=audit(1689213591.650:83): pid=577 uid=1000 auid=1000 ses=3 subj=unconfined msg='cwd="/home/debian" cmd="ls" exe="/usr/bin/sudo" terminal=ttyS0 res=success' ..... ..... # search failure events on [dlp.srv.world] root@dlp:~# ausearch --host dlp.srv.world --success no ---- time-->Wed Jul 12 20:57:56 2023 type=USER_AUTH msg=audit(1689213476.443:37): pid=527 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct="root" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- time-->Wed Jul 12 20:57:59 2023 type=USER_LOGIN msg=audit(1689213479.999:38): pid=527 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=login acct="root" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ..... ..... # search logs by a user who has login userID 1000 from 2023/07/11 to 2023/07/12 root@dlp:~# ausearch --start 07/11/2023 --end 07/12/2023 -ul 1001 ---- time->Wed Jul 12 21:03:05 2023 type=LOGIN msg=audit(1689213785.921:144): pid=642 uid=0 subj=unconfined old-auid=4294967295 auid=1001 tty=ttyS0 old-ses=4294967295 ses=7 res=1 ---- time->Wed Jul 12 21:03:05 2023 type=PROCTITLE msg=audit(1689213785.921:144): proctitle=2F62696E2F6C6F67696E002D70002D2D type=SYSCALL msg=audit(1689213785.921:144): arch=c000003e syscall=1 success=yes exit=4 a0=3 a1=7fff4cb33560 a2=4 a3=7fff4cb33274 items=0 ppid=1 pid=642 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=7 comm="login" exe="/usr/bin/login" subj=unconfined key=(null) ---- time->Wed Jul 12 21:03:05 2023 type=LOGIN msg=audit(1689213785.953:148): pid=648 uid=0 subj=unconfined old-auid=4294967295 auid=1001 tty=(none) old-ses=4294967295 ses=8 res=1 ..... ..... |
| Sponsored Link |