Auditd : Display Summary Logs with aureport2022/12/20

	It's possible to display Audit logs summarily with [aureport] command that is included in Audit package.
[1]	This is how to use [aureport] command.

# display whole summary without arguments

root@dlp:~#

aureport


Summary Report
======================
Range of time in logs: 12/20/2022 11:29:48.328 - 12/20/2022 11:44:19.603
Selected time for report: 12/20/2022 11:29:48 - 12/20/2022 11:44:19.603
Number of changes in configuration: 4
Number of changes to accounts, groups, or roles: 5
Number of logins: 10
Number of failed logins: 3
Number of authentications: 14
Number of failed authentications: 7
Number of users: 4
Number of terminals: 6
Number of host names: 3
Number of executables: 10
Number of commands: 12
Number of files: 0
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 0
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of integrity events: 0
Number of virt events: 0
Number of keys: 0
Number of process IDs: 38
Number of events: 491

# display kind of authentication logs

root@dlp:~#

aureport -au


Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 12/20/2022 11:30:37 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login yes 30
2. 12/20/2022 11:30:43 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 52
3. 12/20/2022 11:30:54 root dlp.srv.world ttyS0 /usr/bin/chfn yes 75
4. 12/20/2022 11:31:05 debian dlp.srv.world /dev/ttyS0 /usr/bin/login yes 84
5. 12/20/2022 11:31:11 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 104
6. 12/20/2022 11:31:20 debian dlp.srv.world /dev/ttyS0 /usr/bin/login yes 127
7. 12/20/2022 11:31:26 debian 127.0.0.1 ssh /usr/sbin/sshd no 141
8. 12/20/2022 11:31:30 debian 127.0.0.1 ssh /usr/sbin/sshd no 143
9. 12/20/2022 11:31:35 debian 127.0.0.1 ssh /usr/sbin/sshd no 145
.....
.....

# display kind of failure authentication logs

root@dlp:~#

aureport -au --failed --summary


Failed Authentication Summary Report
=============================
total  acct
=============================
3  debian
3  ubuntu
1  root

# display kind of modification of user accounts logs

root@dlp:~#

aureport -m -i


Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 68
2. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 69
3. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 70
4. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/useradd ? yes 71
5. 12/20/2022 11:30:54 root dlp.srv.world ttyS0 /usr/bin/passwd debian yes 74

# display kind of modification of user accounts logs since this month

root@dlp:~#

aureport -m -i --start this-month


Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 68
2. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 69
3. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 70
4. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/useradd ? yes 71
5. 12/20/2022 11:30:54 root dlp.srv.world ttyS0 /usr/bin/passwd debian yes 74

# display kind of executing logs

root@dlp:~#

aureport -x -i


Executable Report
====================================
# date time exe term host auid event
====================================
1. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 17
2. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 18
3. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 19
4. 12/20/2022 11:29:48 /usr/lib/systemd/systemd ? ? unset 20
5. 12/20/2022 11:30:29 /usr/bin/login /dev/ttyS0 dlp.srv.world root 23
6. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 26
7. 12/20/2022 11:30:29 /usr/lib/systemd/systemd (none) ? unset 26
8. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 27
9. 12/20/2022 11:30:29 /usr/lib/systemd/systemd (none) ? unset 27
10. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 28
.....
.....

# display kind of executing logs from 2022/12/19 to 2022/12/20

root@dlp:~#

aureport -x -i --start 12/19/2022 --end 12/20/2022


Executable Report
====================================
# date time exe term host auid event
====================================
1. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 17
2. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 18
3. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 19
4. 12/20/2022 11:29:48 /usr/lib/systemd/systemd ? ? unset 20
5. 12/20/2022 11:30:29 /usr/bin/login /dev/ttyS0 dlp.srv.world root 23
.....
.....

[2]	Search and Display logs with [ausearch] and [aureport] like follows.

# search and display sudo logs by UserID 1000

root@dlp:~#

ausearch -x sudo -ua 1000 | aureport -au


Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 12/20/2022 11:32:39 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 191
2. 12/20/2022 11:34:22 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 277
3. 12/20/2022 11:34:26 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 278
4. 12/20/2022 11:34:28 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 279

# search and display executing logs by UserID 1001

root@dlp:~#

ausearch -ui 1001 | aureport -x -i


Executable Report
====================================
# date time exe term host auid event
====================================
1. 12/20/2022 11:33:56 /usr/bin/sudo /dev/ttyS0 dlp.srv.world debian 252
2. 12/20/2022 11:33:56 /usr/bin/sudo ttyS0 ? debian 252
3. 12/20/2022 11:33:56 /usr/bin/sudo /dev/ttyS0 dlp.srv.world debian 253
4. 12/20/2022 11:33:56 /usr/bin/sudo ttyS0 ? debian 253
5. 12/20/2022 11:33:56 /usr/bin/sudo ttyS0 ? debian 254
6. 12/20/2022 11:33:56 /usr/bin/sudo ttyS0 ? debian 254
7. 12/20/2022 11:33:59 /usr/bin/su /dev/ttyS0 dlp.srv.world debian 255
8. 12/20/2022 11:33:59 /usr/bin/su ttyS0 ? debian 255
.....
.....

Matched Content