Rocky_Linux_8
Sponsored Link

Auditd : Display Summary Logs with aureport2021/07/22
 
It's possible to display Audit logs summarily with [aureport] command that is included in Audit package.
[1] This is how to use [aureport] command.
# display whole summary without arguments

[root@dlp ~]#
aureport 


Summary Report
======================
Range of time in logs: 07/16/2021 09:16:40.877 - 07/22/2021 12:59:49.371
Selected time for report: 07/16/2021 09:16:40 - 07/22/2021 12:59:49.371
Number of changes in configuration: 287
Number of changes to accounts, groups, or roles: 3
Number of logins: 8
Number of failed logins: 0
Number of authentications: 11
Number of failed authentications: 0
Number of users: 3
Number of terminals: 4
Number of host names: 5
Number of executables: 14
Number of commands: 17
Number of files: 1
Number of AVC's: 16
Number of MAC events: 22
Number of failed syscalls: 16
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 18
Number of integrity events: 0
Number of virt events: 0
Number of keys: 0
Number of process IDs: 177
Number of events: 1043
# display kind of authentication logs

[root@dlp ~]#
aureport -au 


Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 07/16/2021 09:18:07 root localhost.localdomain ttyS0 /usr/bin/login yes 87
2. 07/16/2021 14:20:27 root localhost.localdomain ttyS0 /usr/bin/login yes 78
3. 07/22/2021 10:39:39 root localhost.localdomain ttyS0 /usr/bin/login yes 81
4. 07/22/2021 10:44:22 root dlp.srv.world ttyS0 /usr/bin/login yes 77
5. 07/22/2021 11:34:26 root dlp.srv.world ttyS0 /usr/bin/login yes 75
6. 07/22/2021 12:47:11 root node01.srv.world ttyS0 /usr/bin/login yes 120
7. 07/22/2021 12:56:03 rocky dlp.srv.world ttyS0 /usr/bin/su yes 134
8. 07/22/2021 12:56:12 rocky dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 139
9. 07/22/2021 12:57:32 root dlp.srv.world ttyS0 /usr/bin/login yes 76
10. 07/22/2021 12:59:23 rocky dlp.srv.world ttyS0 /usr/bin/login yes 105
11. 07/22/2021 12:59:28 root dlp.srv.world ttyS0 /usr/bin/su yes 119
# display kind of failure authentication logs

[root@dlp ~]#
aureport -au --failed --summary 


Failed Authentication Summary Report
=============================
total  acct
=============================
2  rocky
1  root
# display kind of modification of user accounts logs

[root@dlp ~]#
aureport -m -i 


Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 07/22/2021 11:06:46 root ? ? /usr/sbin/groupadd ? yes 96
2. 07/22/2021 11:06:46 root ? ? /usr/sbin/groupadd ? yes 97
3. 07/22/2021 11:06:46 root ? ? /usr/sbin/useradd apache yes 98
4. 07/22/2021 13:03:35 root dlp.srv.world ttyS0 /usr/sbin/useradd redhat yes 164
5. 07/22/2021 13:03:35 root dlp.srv.world ttyS0 /usr/sbin/useradd redhat yes 165
6. 07/22/2021 13:03:36 root dlp.srv.world ttyS0 /usr/sbin/useradd ? yes 166
7. 07/22/2021 13:03:47 root dlp.srv.world ttyS0 /usr/bin/passwd redhat yes 167
8. 07/22/2021 13:04:02 root node01.srv.world ttyS0 /usr/sbin/useradd ubuntu yes 139
9. 07/22/2021 13:04:02 root node01.srv.world ttyS0 /usr/sbin/useradd ubuntu yes 140
10. 07/22/2021 13:04:03 root node01.srv.world ttyS0 /usr/sbin/useradd ? yes 141
11. 07/22/2021 13:04:13 root node01.srv.world ttyS0 /usr/bin/passwd ubuntu yes 142
# display kind of modification of user accounts logs since this month

[root@dlp ~]#
aureport -m -i --start this-month 


Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 07/22/2021 11:06:46 root ? ? /usr/sbin/groupadd ? yes 96
2. 07/22/2021 11:06:46 root ? ? /usr/sbin/groupadd ? yes 97
3. 07/22/2021 11:06:46 root ? ? /usr/sbin/useradd apache yes 98
4. 07/22/2021 13:03:35 root dlp.srv.world ttyS0 /usr/sbin/useradd redhat yes 164
5. 07/22/2021 13:03:35 root dlp.srv.world ttyS0 /usr/sbin/useradd redhat yes 165
6. 07/22/2021 13:03:36 root dlp.srv.world ttyS0 /usr/sbin/useradd ? yes 166
7. 07/22/2021 13:03:47 root dlp.srv.world ttyS0 /usr/bin/passwd redhat yes 167
8. 07/22/2021 13:04:02 root node01.srv.world ttyS0 /usr/sbin/useradd ubuntu yes 139
9. 07/22/2021 13:04:02 root node01.srv.world ttyS0 /usr/sbin/useradd ubuntu yes 140
10. 07/22/2021 13:04:03 root node01.srv.world ttyS0 /usr/sbin/useradd ? yes 141
11. 07/22/2021 13:04:13 root node01.srv.world ttyS0 /usr/bin/passwd ubuntu yes 142
# display kind of executing logs

[root@dlp ~]#
aureport -x -i 


Executable Report
====================================
# date time exe term host auid event
====================================
1. 07/16/2021 09:16:40 /usr/sbin/auditctl (none) ? unset 5
2. 07/16/2021 09:16:40 /usr/sbin/auditctl (none) ? unset 6
3. 07/16/2021 09:16:40 /usr/sbin/auditctl (none) ? unset 7
4. 07/16/2021 09:16:40 /usr/lib/systemd/systemd ? ? unset 8
5. 07/16/2021 09:16:40 /usr/lib/systemd/systemd-update-utmp ? ? unset 9

.....
.....

1049. 07/22/2021 13:02:33 /usr/bin/login ttyS0 dlp.srv.world root 162
1050. 07/22/2021 13:02:36 /usr/lib/systemd/systemd ? ? unset 163
1051. 07/22/2021 13:03:35 /usr/sbin/useradd ttyS0 dlp.srv.world root 164
1052. 07/22/2021 13:03:35 /usr/sbin/useradd ttyS0 dlp.srv.world root 165
1053. 07/22/2021 13:03:36 /usr/sbin/useradd ttyS0 dlp.srv.world root 166
1054. 07/22/2021 13:03:47 /usr/bin/passwd ttyS0 dlp.srv.world root 167
1055. 07/22/2021 13:04:02 /usr/sbin/useradd ttyS0 node01.srv.world root 139
1056. 07/22/2021 13:04:02 /usr/sbin/useradd ttyS0 node01.srv.world root 140
1057. 07/22/2021 13:04:03 /usr/sbin/useradd ttyS0 node01.srv.world root 141
1058. 07/22/2021 13:04:13 /usr/bin/passwd ttyS0 node01.srv.world root 142
# display kind of executing logs from 2021/7/21 to 2021/7/22

[root@dlp ~]#
aureport -x -i --start 07/21/2021 --end 07/22/2021 


Executable Report
====================================
# date time exe term host auid event
====================================
1. 07/22/2021 10:34:07 /usr/sbin/auditctl (none) ? unset 5
2. 07/22/2021 10:34:07 /usr/sbin/auditctl (none) ? unset 6
3. 07/22/2021 10:34:07 /usr/sbin/auditctl (none) ? unset 7
4. 07/22/2021 10:34:07 /usr/lib/systemd/systemd ? ? unset 8
5. 07/22/2021 10:34:07 /usr/lib/systemd/systemd-update-utmp ? ? unset 9

.....
.....

754. 07/22/2021 13:02:33 /usr/bin/login ttyS0 dlp.srv.world root 162
755. 07/22/2021 13:02:36 /usr/lib/systemd/systemd ? ? unset 163
756. 07/22/2021 13:03:35 /usr/sbin/useradd ttyS0 dlp.srv.world root 164
757. 07/22/2021 13:03:35 /usr/sbin/useradd ttyS0 dlp.srv.world root 165
758. 07/22/2021 13:03:36 /usr/sbin/useradd ttyS0 dlp.srv.world root 166
759. 07/22/2021 13:03:47 /usr/bin/passwd ttyS0 dlp.srv.world root 167
760. 07/22/2021 13:04:02 /usr/sbin/useradd ttyS0 node01.srv.world root 139
761. 07/22/2021 13:04:02 /usr/sbin/useradd ttyS0 node01.srv.world root 140
762. 07/22/2021 13:04:03 /usr/sbin/useradd ttyS0 node01.srv.world root 141
763. 07/22/2021 13:04:13 /usr/bin/passwd ttyS0 node01.srv.world root 142
[2] Search and Display logs with [ausearch] and [aureport] like follows.
# search and display sudo logs by UserID 1000

[root@dlp ~]#
ausearch -x sudo -ua 1000 | aureport -au 


Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 07/22/2021 12:56:12 rocky dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 139
# search and display executing logs by UserID 1000

[root@dlp ~]#
ausearch -ui 1000 | aureport -x -i 


Executable Report
====================================
# date time exe term host auid event
====================================
1. 07/22/2021 12:56:12 /usr/bin/sudo /dev/ttyS0 dlp.srv.world root 139
2. 07/22/2021 12:56:12 /usr/bin/sudo /dev/ttyS0 dlp.srv.world root 140
3. 07/22/2021 12:56:12 /usr/bin/sudo ttyS0 ? root 141
4. 07/22/2021 12:56:19 /usr/bin/sudo /dev/ttyS0 dlp.srv.world root 146
5. 07/22/2021 12:56:19 /usr/bin/sudo ttyS0 ? root 147
6. 07/22/2021 12:59:28 /usr/bin/su ttyS0 dlp.srv.world rocky 119
7. 07/22/2021 12:59:28 /usr/bin/su ttyS0 dlp.srv.world rocky 120
8. 07/22/2021 12:59:28 /usr/bin/su ttyS0 dlp.srv.world rocky 121
9. 07/22/2021 12:59:28 /usr/bin/su ttyS0 dlp.srv.world rocky 122
10. 07/22/2021 13:01:59 /usr/bin/su ttyS0 dlp.srv.world rocky 124
11. 07/22/2021 13:01:59 /usr/bin/su ttyS0 dlp.srv.world rocky 125
Matched Content