Auditd : aureport でログをサマリー表示する2024/06/18

	Audit パッケージに同梱されている [aureport] コマンドを利用することにより、[audit.log] に記録された膨大なログをサマリー出力することができます。
[1]	[aureport] コマンドの使用例です。

# 引数なしで全体のサマリーを表示

root@dlp:~#

aureport


Summary Report
======================
Range of time in logs: 06/17/2024 00:53:34.760 - 06/17/2024 01:45:01.485
Selected time for report: 06/17/2024 00:53:34 - 06/17/2024 01:45:01.485
Number of changes in configuration: 18
Number of changes to accounts, groups, or roles: 0
Number of logins: 9
Number of failed logins: 4
Number of authentications: 10
Number of failed authentications: 7
Number of users: 3
Number of terminals: 5
Number of host names: 2
Number of executables: 7
Number of commands: 6
Number of files: 0
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 0
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of integrity events: 0
Number of virt events: 0
Number of keys: 0
Number of process IDs: 59
Number of events: 825

# 認証系の監査ログ表示

root@dlp:~#

aureport -au


Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 06/17/2024 00:58:34 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login no 134
2. 06/17/2024 00:58:40 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login no 139
3. 06/17/2024 00:58:48 noble dlp.srv.world /dev/ttyS0 /usr/bin/login no 141
4. 06/17/2024 00:58:56 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 143
5. 06/17/2024 00:59:05 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login yes 162
6. 06/17/2024 00:59:14 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 176
7. 06/17/2024 00:59:29 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login yes 192
8. 06/17/2024 00:59:31 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 198
9. 06/17/2024 00:59:37 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 199
10. 06/17/2024 00:59:40 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 200
.....
.....

# 認証系の監査ログを失敗のみに絞ってサマリー形式で表示

root@dlp:~#

aureport -au --failed --summary


Failed Authentication Summary Report
=============================
total  acct
=============================
5  ubuntu
1  noble
1  root

# ユーザーアカウント操作ログを表示
# ユーザー ID 番号はユーザー ID 名で表示

root@dlp:~#

aureport -m -i


Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 205
2. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 206
3. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 207
4. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/useradd ? yes 208
5. 06/17/2024 01:48:41 ubuntu dlp.srv.world pts/0 /usr/bin/passwd noble no 209
6. 06/17/2024 01:48:48 ubuntu dlp.srv.world pts/0 /usr/bin/passwd noble yes 210

# 今月以降のユーザーアカウント操作ログを表示

root@dlp:~#

aureport -m -i --start this-month


Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 205
2. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 206
3. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/groupadd ? yes 207
4. 06/17/2024 01:48:36 ubuntu dlp.srv.world pts/0 /usr/sbin/useradd ? yes 208
5. 06/17/2024 01:48:41 ubuntu dlp.srv.world pts/0 /usr/bin/passwd noble no 209
6. 06/17/2024 01:48:48 ubuntu dlp.srv.world pts/0 /usr/bin/passwd noble yes 210

# プログラムの実行ログを表示

root@dlp:~#

aureport -x -i


Executable Report
====================================
# date time exe term host auid event
====================================
1. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 118
2. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 119
3. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 120
4. 06/17/2024 00:53:34 /usr/lib/systemd/systemd ? ? unset 121
5. 06/17/2024 00:55:01 /usr/sbin/cron cron ? unset 122
6. 06/17/2024 00:55:01 /usr/sbin/cron cron ? unset 123
7. 06/17/2024 00:55:01 /usr/sbin/cron (none) ? root 124
8. 06/17/2024 00:55:01 /usr/sbin/cron cron ? root 125
9. 06/17/2024 00:55:01 /usr/sbin/cron cron ? root 126
10. 06/17/2024 00:55:01 /usr/sbin/cron cron ? root 127
.....
.....

# 2024/06/01 ～ 2024/06/17 間に発生したプログラムの実行ログを表示
# Year の指定は LC_TIME に依存する
# 下例の 4 桁指定は [en_US.UTF-8] の場合だが
# [ja_JP.UTF-8] や [C.UTF-8] の場合は Year は 2 桁で指定する

root@dlp:~#

aureport -x -i --start 06/01/2024 --end 06/17/2024


Executable Report
====================================
# date time exe term host auid event
====================================
1. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 118
2. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 119
3. 06/17/2024 00:53:34 /usr/sbin/auditctl (none) ? unset 120
4. 06/17/2024 00:53:34 /usr/lib/systemd/systemd ? ? unset 121
5. 06/17/2024 00:55:01 /usr/sbin/cron cron ? unset 122
.....
.....

[2]	[ausearch] と組み合わせることで、検索した特定のログをサマリー表示できます。

# ユーザー ID 1000 の sudo 実行履歴のログを表示

root@dlp:~#

ausearch -x sudo -ua 1000 | aureport -au


Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 06/17/24 00:59:14 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 176
2. 06/17/24 00:59:31 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 198
3. 06/17/24 00:59:37 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 199
4. 06/17/24 00:59:40 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 200
5. 06/17/24 01:48:36 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 200

# ユーザー ID 1001 のユーザーのプログラムの実行ログを表示

root@dlp:~#

ausearch -ui 1001 | aureport -x -i


Executable Report
====================================
# date time exe term host auid event
====================================
1. 06/17/2024 02:17:10 /usr/bin/su /dev/ttyS0 dlp.srv.world noble 282
2. 06/17/2024 02:26:32 /usr/bin/sudo /dev/ttyS0 dlp.srv.world noble 292
3. 06/17/2024 02:26:37 /usr/bin/sudo /dev/ttyS0 dlp.srv.world noble 293
4. 06/17/2024 02:26:40 /usr/bin/sudo /dev/ttyS0 dlp.srv.world noble 294
5. 06/17/2024 02:26:41 /usr/bin/sudo ttyS0 ? noble 295
6. 06/17/2024 02:26:41 /usr/bin/sudo ttyS0 ? noble 296
.....
.....