CentOS Stream 9
Sponsored Link

Auditd : Display Summary Logs with aureport
2022/03/11
 
It's possible to display Audit logs summarily with [aureport] command that is included in Audit package.
[1] This is how to use [aureport] command.
# display whole summary without arguments

[root@dlp ~]#
aureport


Summary Report
======================
Range of time in logs: 11/25/2021 18:25:45.522 - 03/10/2022 23:26:12.211
Selected time for report: 11/25/2021 18:25:45 - 03/10/2022 23:26:12.211
Number of changes in configuration: 225
Number of changes to accounts, groups, or roles: 6
Number of logins: 23
Number of failed logins: 0
Number of authentications: 25
Number of failed authentications: 4
Number of users: 3
Number of terminals: 4
Number of host names: 5
Number of executables: 18
Number of commands: 14
Number of files: 1
Number of AVC's: 11
Number of MAC events: 64
Number of failed syscalls: 11
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 22
Number of integrity events: 0
Number of virt events: 0
Number of keys: 0
Number of process IDs: 171
Number of events: 3755

# display kind of authentication logs

[root@dlp ~]#
aureport -au


Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 11/25/2021 18:26:50 root localhost.localdomain /dev/ttyS0 /usr/bin/login yes 69
2. 11/26/2021 01:22:54 root localhost.localdomain /dev/ttyS0 /usr/bin/login yes 61
3. 12/07/2021 22:31:29 root localhost.localdomain /dev/ttyS0 /usr/bin/login yes 64
4. 12/07/2021 22:36:31 root localhost.localdomain /dev/ttyS0 /usr/bin/login yes 50
5. 12/20/2021 18:55:21 root localhost.localdomain /dev/ttyS0 /usr/bin/login yes 64
.....
.....
25. 03/10/2022 23:25:15 root dlp.srv.world /dev/ttyS0 /usr/bin/su no 406
26. 03/10/2022 23:25:26 cent dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 410
27. 03/10/2022 23:25:30 cent dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 411
28. 03/10/2022 23:25:33 cent dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 412
29. 03/10/2022 23:25:41 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 422

# display kind of failure authentication logs

[root@dlp ~]#
aureport -au --failed --summary


Failed Authentication Summary Report
=============================
total  acct
=============================
3  cent
1  root

# display kind of modification of user accounts logs

[root@dlp ~]#
aureport -m -i


Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 03/10/2022 22:04:12 root ? ? /usr/sbin/groupadd ? yes 146
2. 03/10/2022 22:04:12 root ? ? /usr/sbin/groupadd ? yes 147
3. 03/10/2022 22:04:12 root ? ? /usr/sbin/useradd apache yes 148
4. 03/10/2022 23:19:46 root ? ? /usr/sbin/groupadd ? yes 125
5. 03/10/2022 23:19:46 root ? ? /usr/sbin/groupadd ? yes 126
6. 03/10/2022 23:19:46 root ? ? /usr/sbin/useradd apache yes 127

# display kind of modification of user accounts logs since this month

[root@dlp ~]#
aureport -m -i --start this-month


Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 03/10/2022 22:04:12 root ? ? /usr/sbin/groupadd ? yes 146
2. 03/10/2022 22:04:12 root ? ? /usr/sbin/groupadd ? yes 147
3. 03/10/2022 22:04:12 root ? ? /usr/sbin/useradd apache yes 148
4. 03/10/2022 23:19:46 root ? ? /usr/sbin/groupadd ? yes 125
5. 03/10/2022 23:19:46 root ? ? /usr/sbin/groupadd ? yes 126
6. 03/10/2022 23:19:46 root ? ? /usr/sbin/useradd apache yes 127

# display kind of executing logs

[root@dlp ~]#
aureport -x -i


Executable Report
====================================
# date time exe term host auid event
====================================
1. 11/25/2021 18:25:45 /usr/sbin/auditctl (none) ? unset 5
2. 11/25/2021 18:25:45 /usr/sbin/auditctl (none) ? unset 6
3. 11/25/2021 18:25:45 /usr/sbin/auditctl (none) ? unset 7
4. 11/25/2021 18:25:45 /usr/lib/systemd/systemd ? ? unset 8
5. 11/25/2021 18:25:45 /usr/lib/systemd/systemd-update-utmp ? ? unset 9
.....
.....
2694. 03/10/2022 23:25:47 /usr/lib/systemd/systemd ? ? unset 441
2695. 03/10/2022 23:25:47 /usr/lib/systemd/systemd ? ? unset 442
2696. 03/10/2022 23:26:04 /usr/lib/systemd/systemd ? ? unset 162
2697. 03/10/2022 23:26:04 /usr/lib/systemd/systemd ? ? unset 163
2698. 03/10/2022 23:26:12 /usr/lib/systemd/systemd ? ? unset 443

# display kind of executing logs from 2022/3/10 to 2022/3/11

[root@dlp ~]#
aureport -x -i --start 03/10/2022 --end 03/11/2022


Executable Report
====================================
# date time exe term host auid event
====================================
1. 03/10/2022 18:59:36 /usr/sbin/auditctl (none) ? unset 5
2. 03/10/2022 18:59:36 /usr/sbin/auditctl (none) ? unset 6
3. 03/10/2022 18:59:36 /usr/sbin/auditctl (none) ? unset 7
4. 03/10/2022 18:59:36 /usr/lib/systemd/systemd ? ? unset 8
5. 03/10/2022 18:59:36 /usr/lib/systemd/systemd-update-utmp ? ? unset 9
.....
.....
903. 03/10/2022 23:25:47 /usr/lib/systemd/systemd ? ? unset 441
904. 03/10/2022 23:25:47 /usr/lib/systemd/systemd ? ? unset 442
905. 03/10/2022 23:26:04 /usr/lib/systemd/systemd ? ? unset 162
906. 03/10/2022 23:26:04 /usr/lib/systemd/systemd ? ? unset 163
907. 03/10/2022 23:26:12 /usr/lib/systemd/systemd ? ? unset 443
[2] Search and Display logs with [ausearch] and [aureport] like follows.
# search and display sudo logs by UserID 1000

[root@dlp ~]#
ausearch -x sudo -ua 1000 | aureport -au


Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 03/10/2022 23:21:54 cent dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 341
2. 03/10/2022 23:25:26 cent dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 410
3. 03/10/2022 23:25:30 cent dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 411
4. 03/10/2022 23:25:33 cent dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 412

# search and display executing logs by UserID 1000

[root@dlp ~]#
ausearch -ui 1000 | aureport -x -i


Executable Report
====================================
# date time exe term host auid event
====================================
1. 03/10/2022 23:21:19 /usr/bin/su /dev/ttyS0 dlp.srv.world cent 280
2. 03/10/2022 23:21:19 /usr/bin/su /dev/ttyS0 dlp.srv.world cent 281
3. 03/10/2022 23:21:19 /usr/bin/su /dev/ttyS0 dlp.srv.world cent 282
4. 03/10/2022 23:21:19 /usr/bin/su /dev/ttyS0 dlp.srv.world cent 283
5. 03/10/2022 23:21:32 /usr/bin/su /dev/ttyS0 dlp.srv.world cent 284
.....
.....
15. 03/10/2022 23:25:26 /usr/bin/sudo /dev/ttyS0 dlp.srv.world cent 410
16. 03/10/2022 23:25:30 /usr/bin/sudo /dev/ttyS0 dlp.srv.world cent 411
17. 03/10/2022 23:25:33 /usr/bin/sudo /dev/ttyS0 dlp.srv.world cent 412
18. 03/10/2022 23:25:35 /usr/bin/sudo ttyS0 ? cent 413
Matched Content