Auditd : Display Summary Logs with aureport2024/06/18 |
|
It's possible to display Audit logs summarily with [aureport] command that is included in Audit package. |
|
| [1] | This is how to use [aureport] command. |
|
# display whole summary without arguments root@dlp:~# aureport Summary Report ====================== Range of time in logs: 06/17/2024 00:53:34.760 - 06/17/2024 01:45:01.485 Selected time for report: 06/17/2024 00:53:34 - 06/17/2024 01:45:01.485 Number of changes in configuration: 18 Number of changes to accounts, groups, or roles: 0 Number of logins: 9 Number of failed logins: 4 Number of authentications: 10 Number of failed authentications: 7 Number of users: 3 Number of terminals: 5 Number of host names: 2 Number of executables: 7 Number of commands: 6 Number of files: 0 Number of AVC's: 0 Number of MAC events: 0 Number of failed syscalls: 0 Number of anomaly events: 0 Number of responses to anomaly events: 0 Number of crypto events: 0 Number of integrity events: 0 Number of virt events: 0 Number of keys: 0 Number of process IDs: 59 Number of events: 825 # display the kind of authentication logs root@dlp:~# aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 06/17/2024 00:58:34 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login no 134 2. 06/17/2024 00:58:40 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login no 139 3. 06/17/2024 00:58:48 noble dlp.srv.world /dev/ttyS0 /usr/bin/login no 141 4. 06/17/2024 00:58:56 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 143 5. 06/17/2024 00:59:05 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login yes 162 6. 06/17/2024 00:59:14 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 176 7. 06/17/2024 00:59:29 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login yes 192 8. 06/17/2024 00:59:31 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 198 9. 06/17/2024 00:59:37 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 199 10. 06/17/2024 00:59:40 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 200 ..... ..... # display the kind of failure authentication logs root@dlp:~# aureport -au --failed --summary Failed Authentication Summary Report ============================= total acct ============================= 5 ubuntu 1 noble 1 root # display the kind of modification of user accounts logs root@dlp:~# aureport -m -i Account Modifications Report ================================================= # date time auid addr term exe acct success event ================================================= 1. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 205 2. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 206 3. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 207 4. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/useradd ? yes 208 5. 06/17/2024 01:48:41 ubuntu dlp.srv.world pts/0 /usr/bin/passwd noble no 209 6. 06/17/2024 01:48:48 ubuntu dlp.srv.world pts/0 /usr/bin/passwd noble yes 210 # display the kind of modification of user accounts logs since this month root@dlp:~# aureport -m -i --start this-month Account Modifications Report ================================================= # date time auid addr term exe acct success event ================================================= 1. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 205 2. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 206 3. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 207 4. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/useradd ? yes 208 5. 06/17/2024 01:48:41 ubuntu dlp.srv.world pts/0 /usr/bin/passwd noble no 209 6. 06/17/2024 01:48:48 ubuntu dlp.srv.world pts/0 /usr/bin/passwd noble yes 210 # display the kind of executing logs root@dlp:~# aureport -x -i Executable Report ==================================== # date time exe term host auid event ==================================== 1. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 17 2. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 18 3. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 19 4. 12/20/2022 11:29:48 /usr/lib/systemd/systemd ? ? unset 20 5. 12/20/2022 11:30:29 /usr/bin/login /dev/ttyS0 dlp.srv.world root 23 6. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 26 7. 12/20/2022 11:30:29 /usr/lib/systemd/systemd (none) ? unset 26 8. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 27 9. 12/20/2022 11:30:29 /usr/lib/systemd/systemd (none) ? unset 27 10. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 28 ..... ..... # display the kind of executing logs from 2024/06/01 to 2024/06/17 # The Year specification depends on LC_TIME # The four-digit specification in the example below is for [en_US.UTF-8] # if [C.UTF-8], specify the Year in two digits ⇒ 06/01/24 root@dlp:~# aureport -x -i --start 06/01/2024 --end 06/17/2024 Executable Report ==================================== # date time exe term host auid event ==================================== 1. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 118 2. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 119 3. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 120 4. 06/17/2024 00:53:34 /usr/lib/systemd/systemd ? ? unset 121 5. 06/17/2024 00:55:01 /usr/sbin/cron cron ? unset 122 ..... ..... |
| [2] | Search and Display logs with [ausearch] and [aureport] like follows. |
|
# search and display sudo logs by UserID 1000 root@dlp:~# ausearch -x sudo -ua 1000 | aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 06/17/24 00:59:14 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 176 2. 06/17/24 00:59:31 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 198 3. 06/17/24 00:59:37 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 199 4. 06/17/24 00:59:40 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 200 5. 06/17/24 01:48:36 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 200 # search and display executing logs by UserID 1001 root@dlp:~# ausearch -ui 1001 | aureport -x -i Executable Report ==================================== # date time exe term host auid event ==================================== 1. 06/17/2024 02:17:10 /usr/bin/su /dev/ttyS0 dlp.srv.world noble 282 2. 06/17/2024 02:26:32 /usr/bin/sudo /dev/ttyS0 dlp.srv.world noble 292 3. 06/17/2024 02:26:37 /usr/bin/sudo /dev/ttyS0 dlp.srv.world noble 293 4. 06/17/2024 02:26:40 /usr/bin/sudo /dev/ttyS0 dlp.srv.world noble 294 5. 06/17/2024 02:26:41 /usr/bin/sudo ttyS0 ? noble 295 6. 06/17/2024 02:26:41 /usr/bin/sudo ttyS0 ? noble 296 ..... ..... |
| Sponsored Link |