Auditd : Search Logs with ausearch2019/09/28 |
|
Some Audit rules are set by default like System Login, Modification of User Accounts, Sudo Actions and so on,
there logs are recorded in [/var/log/audit/audit.log].
|
|
| [1] | The logs are text format, so it's possible to see logs directly. |
|
[root@dlp ~]# tail -3 /var/log/audit/audit.log type=USER_LOGIN msg=audit(1569565170.307:61): pid=853 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/bin/login" hostname=node01.srv.world addr=? terminal=ttyS0 res=success' type=SERVICE_STOP msg=audit(1569565196.821:62): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' type=SOFTWARE_UPDATE msg=audit(1569565408.223:76): pid=1675 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="epel-release-8-5.el8.noarch" sw_type=rpm key_enforce=0 gpg_res=1 root_dir="/" comm="dnf" exe="/usr/libexec/platform-python3.6" hostname=dlp.srv.world addr=? terminal=ttyS0 res=success'UID="root" AUID="root" |
| [2] | Many logs are recorded in [audit.log] and they are complicated, so [ausearch] command is provided by Audit package to search specific logs. |
|
# search USER_LOGIN related logs [root@dlp ~]# ausearch --message USER_LOGIN --interpret ---- type=USER_LOGIN msg=audit(09/26/2019 18:28:45.116:61) : pid=851 uid=root auid=root ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=root exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=ttyS0 res=success' ---- type=USER_LOGIN msg=audit(09/26/2019 19:51:55.205:61) : pid=846 uid=root auid=root ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=root exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=ttyS0 res=success' ---- type=USER_LOGIN msg=audit(09/26/2019 20:19:30.307:61) : pid=853 uid=root auid=root ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=root exe=/usr/bin/login hostname=node01.srv.world addr=? terminal=ttyS0 res=success # search sudo actions by userID 1000 [root@dlp ~]# ausearch -x sudo -ua 1000 ---- time->Fri Sep 26 19:30:33 2019 type=USER_AUTH msg=audit(1569565833.491:82): pid=1756 uid=1000 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_succeed_if,pam_localuser,pam_unix acct="cent" exe="/usr/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Fri Sep 26 19:30:33 2019 type=USER_ACCT msg=audit(1569565833.503:83): pid=1756 uid=1000 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="cent" exe="/usr/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Fri Sep 26 19:30:40 2019 type=USER_ACCT msg=audit(1569565840.389:89): pid=1763 uid=1000 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="cent" exe="/usr/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' # search failure events on [dlp.srv.world] [root@dlp ~]# ausearch --node dlp.srv.world --success no
----
time->Fri Sep 26 19:33:21 2019
type=PROCTITLE msg=audit(1569566001.331:126): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1569566001.331:126): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=55c2cdde7280 a2=10 a3=7ffc3e9c10dc items=0 ppid=1 pid=1790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1569566001.331:126): avc: denied { name_bind } for pid=1790 comm="httpd" src=83 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket permissive=0
----
time->Fri Sep 26 19:33:21 2019
type=SERVICE_START msg=audit(1569566001.356:127): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=httpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
# search logs by a user who has login userID 1000 from 2019/9/26 to 2019/9/28 [root@dlp ~]# ausearch --start 09/26/2019 --end 09/28/2019 -ul 1000 ---- time->Fri Sep 27 19:37:19 2019 type=USER_AUTH msg=audit(1569566239.063:135): pid=1841 uid=1000 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=? acct="cent" exe="/usr/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- time->Fri Sep 27 19:37:20 2019 type=USER_CMD msg=audit(1569566240.786:136): pid=1841 uid=1000 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/cent" cmd="ls" terminal=ttyS0 res=failed' |
| Sponsored Link |
|
|