Auditd : Display Summary Logs with aureport2025/08/17 |
|
It's possible to display Audit logs summarily with [aureport] command that is included in Audit package. |
|
| [1] | This is how to use [aureport] command. |
|
# display whole summary without arguments root@dlp:~# aureport Summary Report ====================== Range of time in logs: 08/15/2025 13:33:28.757 - 08/15/2025 13:42:49.280 Selected time for report: 08/15/2025 13:33:28 - 08/15/2025 13:42:49.280 Number of changes in configuration: 0 Number of changes to accounts, groups, or roles: 5 Number of logins: 7 Number of failed logins: 1 Number of authentications: 13 Number of failed authentications: 5 Number of users: 4 Number of terminals: 4 Number of host names: 2 Number of executables: 11 Number of commands: 4 Number of files: 0 Number of AVC's: 0 Number of MAC events: 0 Number of failed syscalls: 0 Number of anomaly events: 0 Number of responses to anomaly events: 0 Number of crypto events: 0 Number of integrity events: 0 Number of virt events: 0 Number of keys: 0 Number of process IDs: 36 Number of events: 380 # display kind of authentication logs root@dlp:~# aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 08/15/2025 13:35:24 debian dlp.srv.world /dev/ttyS0 /usr/bin/login yes 113 2. 08/15/2025 13:35:28 root dlp.srv.world /dev/ttyS0 /usr/bin/su yes 126 3. 08/15/2025 13:35:40 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 140 4. 08/15/2025 13:36:08 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 123 5. 08/15/2025 13:37:33 debian dlp.srv.world /dev/ttyS0 /usr/bin/su yes 168 6. 08/15/2025 13:37:40 debian dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 172 7. 08/15/2025 13:39:03 debian dlp.srv.world /dev/ttyS0 /usr/bin/su yes 193 8. 08/15/2025 13:39:17 debian dlp.srv.world /dev/ttyS0 /usr/bin/login no 227 9. 08/15/2025 13:39:24 debian dlp.srv.world /dev/ttyS0 /usr/bin/login yes 231 10. 08/15/2025 13:39:26 root dlp.srv.world /dev/ttyS0 /usr/bin/su no 244 ..... ..... # display kind of failure authentication logs root@dlp:~# aureport -au --failed --summary Failed Authentication Summary Report ============================= total acct ============================= 4 root 3 trixie 1 debian # display kind of modification of user accounts logs root@dlp:~# aureport -m -i Account Modifications Report ================================================= # date time auid addr term exe acct success event ================================================= 1. 08/15/2025 13:40:57 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 297 2. 08/15/2025 13:40:57 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 298 3. 08/15/2025 13:40:57 root dlp.srv.world ttyS0 /usr/sbin/useradd trixie yes 299 4. 08/15/2025 13:41:01 root dlp.srv.world ttyS0 /usr/bin/passwd trixie yes 300 5. 08/15/2025 13:41:03 root dlp.srv.world ttyS0 /usr/bin/gpasswd debian,trixie yes 303 ..... ..... # display kind of modification of user accounts logs since this month root@dlp:~# aureport -m -i --start this-month Account Modifications Report ================================================= # date time auid addr term exe acct success event ================================================= 1. 08/15/2025 13:40:57 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 297 2. 08/15/2025 13:40:57 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 298 3. 08/15/2025 13:40:57 root dlp.srv.world ttyS0 /usr/sbin/useradd trixie yes 299 4. 08/15/2025 13:41:01 root dlp.srv.world ttyS0 /usr/bin/passwd trixie yes 300 5. 08/15/2025 13:41:03 root dlp.srv.world ttyS0 /usr/bin/gpasswd debian,trixie yes 303 ..... ..... # display kind of executing logs root@dlp:~# aureport -x -i Executable Report ==================================== # date time exe term host auid event ==================================== 1. 08/15/2025 13:33:28 /usr/lib/systemd/systemd ? ? unset 108 2. 08/15/2025 13:35:18 /usr/bin/login /dev/ttyS0 dlp.srv.world root 109 3. 08/15/2025 13:35:18 /usr/bin/login /dev/ttyS0 dlp.srv.world root 110 4. 08/15/2025 13:35:18 /usr/lib/systemd/systemd ? ? unset 111 5. 08/15/2025 13:35:19 /usr/lib/systemd/systemd ? ? unset 112 6. 08/15/2025 13:35:24 /usr/bin/login /dev/ttyS0 dlp.srv.world unset 113 7. 08/15/2025 13:35:24 /usr/bin/login /dev/ttyS0 dlp.srv.world unset 114 8. 08/15/2025 13:35:24 /usr/bin/login /dev/ttyS0 dlp.srv.world unset 115 9. 08/15/2025 13:35:24 /usr/bin/login ttyS0 ? debian 116 10. 08/15/2025 13:35:24 /usr/lib/systemd/systemd ? ? unset 117 ..... ..... # display kind of executing logs from 2025/08/14 to 2025/08/15 root@dlp:~# aureport -x -i --start 08/14/2025 --end 08/15/2025 Executable Report ==================================== # date time exe term host auid event ==================================== 1. 08/15/2025 13:33:28 /usr/lib/systemd/systemd ? ? unset 108 2. 08/15/2025 13:35:18 /usr/bin/login /dev/ttyS0 dlp.srv.world root 109 3. 08/15/2025 13:35:18 /usr/bin/login /dev/ttyS0 dlp.srv.world root 110 4. 08/15/2025 13:35:18 /usr/lib/systemd/systemd ? ? unset 111 5. 08/15/2025 13:35:19 /usr/lib/systemd/systemd ? ? unset 112 6. 08/15/2025 13:35:24 /usr/bin/login /dev/ttyS0 dlp.srv.world unset 113 7. 08/15/2025 13:35:24 /usr/bin/login /dev/ttyS0 dlp.srv.world unset 114 8. 08/15/2025 13:35:24 /usr/bin/login /dev/ttyS0 dlp.srv.world unset 115 9. 08/15/2025 13:35:24 /usr/bin/login ttyS0 ? debian 116 10. 08/15/2025 13:35:24 /usr/lib/systemd/systemd ? ? unset 117 ..... ..... |
| [2] | Search and Display logs with [ausearch] and [aureport] like follows. |
|
# search and display sudo logs by UserID 1000 root@dlp:~# ausearch -x sudo -ua 1000 | aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 08/15/2025 13:37:40 debian dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 172 2. 08/15/2025 13:52:03 debian dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 447 # search and display executing logs by UserID 1001 root@dlp:~# ausearch -ui 1001 | aureport -x -i Executable Report ==================================== # date time exe term host auid event ==================================== 1. 08/15/2025 13:41:10 /usr/bin/su /dev/ttyS0 dlp.srv.world root 308 2. 08/15/2025 13:41:28 /usr/bin/su /dev/ttyS0 dlp.srv.world trixie 328 3. 08/15/2025 13:53:14 /usr/bin/su /dev/ttyS0 dlp.srv.world root 466 4. 08/15/2025 13:53:14 /usr/bin/su /dev/ttyS0 dlp.srv.world root 467 5. 08/15/2025 13:53:14 /usr/bin/su /dev/ttyS0 dlp.srv.world root 468 6. 08/15/2025 13:53:14 /usr/bin/su /dev/ttyS0 dlp.srv.world root 469 7. 08/15/2025 13:53:15 /usr/bin/su /dev/ttyS0 dlp.srv.world root 470 8. 08/15/2025 13:53:15 /usr/bin/su /dev/ttyS0 dlp.srv.world root 471 ..... ..... |
| Sponsored Link |