Auditd : Search Logs with ausearch2024/06/18 |
|
Some Audit rules are set by default like System Login, Modification of User Accounts, Sudo Actions and so on, there logs are recorded in [/var/log/audit/audit.log]. |
|
| [1] | The logs are text format, so it's possible to see logs directly. |
|
root@dlp:~# tail -5 /var/log/audit/audit.log type=CRED_REFR msg=audit(1718585701.931:126): pid=1493 uid=0 auid=0 ses=3 subj=unconfined msg='op=PAM:setcred grantors=pam_permit,pam_cap acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'UID="root" AUID="root" type=CRED_DISP msg=audit(1718585701.932:127): pid=1492 uid=0 auid=0 ses=3 subj=unconfined msg='op=PAM:setcred grantors=pam_permit acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'UID="root" AUID="root" type=USER_END msg=audit(1718585701.933:128): pid=1492 uid=0 auid=0 ses=3 subj=unconfined msg='op=PAM:session_close grantors=pam_loginuid,pam_env,pam_env,pam_permit,pam_umask,pam_unix,pam_limits acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'UID="root" AUID="root" type=SERVICE_START msg=audit(1718585702.194:129): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=update-notifier-download comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=SERVICE_STOP msg=audit(1718585702.194:130): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=update-notifier-download comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" |
| [2] | Many logs are recorded in [audit.log] and they are complicated, so [ausearch] command is provided by Audit package to search specific logs. |
|
# search USER_LOGIN related logs root@dlp:~# ausearch --message USER_LOGIN --interpret ---- type=USER_LOGIN msg=audit(06/17/24 00:58:37.014:135) : pid=1502 uid=root auid=unset ses=unset subj=unconfined msg='op=login acct=ubuntu exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- type=USER_LOGIN msg=audit(06/17/24 00:58:44.334:140) : pid=1502 uid=root auid=unset ses=unset subj=unconfined msg='op=login acct=ubuntu exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- type=USER_LOGIN msg=audit(06/17/24 00:58:51.772:142) : pid=1502 uid=root auid=unset ses=unset subj=unconfined msg='op=login acct=UNKNOWN exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- type=USER_LOGIN msg=audit(06/17/24 00:58:56.998:158) : pid=1502 uid=root auid=root ses=4 subj=unconfined msg='op=login acct=root exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- type=USER_LOGIN msg=audit(06/17/24 00:59:05.799:173) : pid=1595 uid=root auid=ubuntu ses=6 subj=unconfined msg='op=login acct=ubuntu exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ..... ..... # search sudo actions by userID 1000 root@dlp:~# ausearch -x sudo -ua 1000 ---- time->Mon Jun 17 00:59:14 2024 type=USER_AUTH msg=audit(1718585954.082:176): pid=1674 uid=1000 auid=1000 ses=6 subj=unconfined msg='op=PAM:authentication grantors=pam_permit,pam_cap acct="ubuntu" exe="/usr/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Mon Jun 17 00:59:14 2024 type=USER_ACCT msg=audit(1718585954.082:177): pid=1674 uid=1000 auid=1000 ses=6 subj=unconfined msg='op=PAM:accounting grantors=pam_permit acct="ubuntu" exe="/usr/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Mon Jun 17 00:59:14 2024 type=USER_CMD msg=audit(1718585954.082:178): pid=1674 uid=1000 auid=1000 ses=6 subj=unconfined msg='cwd="/home/ubuntu" cmd=636174202F6574632F736861646F7771 exe="/usr/bin/sudo" terminal=ttyS0 res=success' ..... ..... # search failure events on [dlp.srv.world] root@dlp:~# ausearch --host dlp.srv.world --success no ---- time->Mon Jun 17 00:58:34 2024 type=USER_AUTH msg=audit(1718585914.006:134): pid=1502 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct="ubuntu" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- time->Mon Jun 17 00:58:37 2024 type=USER_LOGIN msg=audit(1718585917.014:135): pid=1502 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=login acct="ubuntu" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- time->Mon Jun 17 00:58:40 2024 type=USER_AUTH msg=audit(1718585920.798:139): pid=1502 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct="ubuntu" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ..... ..... # search logs by a user who has login userID 1000 from 2024/06/01 to 2024/06/17 # The Year specification depends on LC_TIME # The four-digit specification in the example below is for [en_US.UTF-8] # if [C.UTF-8], specify the Year in two digits ⇒ 06/01/24 root@dlp:~# ausearch --start 06/01/2024 --end 06/17/2024 -ul 1000 ---- time->Mon Jun 17 00:59:05 2024 type=LOGIN msg=audit(1718585945.654:164): pid=1595 uid=0 subj=unconfined old-auid=4294967295 auid=1000 tty=ttyS0 old-ses=4294967295 ses=6 res=1 ---- time->Mon Jun 17 00:59:05 2024 type=PROCTITLE msg=audit(1718585945.654:164): proctitle=2F62696E2F6C6F67696E002D70002D2D type=SYSCALL msg=audit(1718585945.654:164): arch=c000003e syscall=1 success=yes exit=4 a0=3 a1=7ffddcd47810 a2=4 a3=0 items=0 ppid=1 pid=1595 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=6 comm="login" exe="/usr/bin/login" subj=unconfined key=(null) ---- time->Mon Jun 17 00:59:05 2024 type=LOGIN msg=audit(1718585945.704:168): pid=1644 uid=0 subj=unconfined old-auid=4294967295 auid=1000 tty=(none) old-ses=4294967295 ses=7 res=1 ..... ..... |
| Sponsored Link |