Auditd : Display Summary Logs with aureport2022/12/20 |
|
It's possible to display Audit logs summarily with [aureport] command that is included in Audit package.
|
|
| [1] | This is how to use [aureport] command. |
|
# display whole summary without arguments root@dlp:~# aureport Summary Report ====================== Range of time in logs: 12/20/2022 11:29:48.328 - 12/20/2022 11:44:19.603 Selected time for report: 12/20/2022 11:29:48 - 12/20/2022 11:44:19.603 Number of changes in configuration: 4 Number of changes to accounts, groups, or roles: 5 Number of logins: 10 Number of failed logins: 3 Number of authentications: 14 Number of failed authentications: 7 Number of users: 4 Number of terminals: 6 Number of host names: 3 Number of executables: 10 Number of commands: 12 Number of files: 0 Number of AVC's: 0 Number of MAC events: 0 Number of failed syscalls: 0 Number of anomaly events: 0 Number of responses to anomaly events: 0 Number of crypto events: 0 Number of integrity events: 0 Number of virt events: 0 Number of keys: 0 Number of process IDs: 38 Number of events: 491 # display kind of authentication logs root@dlp:~# aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 12/20/2022 11:30:37 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login yes 30 2. 12/20/2022 11:30:43 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 52 3. 12/20/2022 11:30:54 root dlp.srv.world ttyS0 /usr/bin/chfn yes 75 4. 12/20/2022 11:31:05 debian dlp.srv.world /dev/ttyS0 /usr/bin/login yes 84 5. 12/20/2022 11:31:11 root dlp.srv.world /dev/ttyS0 /usr/bin/login yes 104 6. 12/20/2022 11:31:20 debian dlp.srv.world /dev/ttyS0 /usr/bin/login yes 127 7. 12/20/2022 11:31:26 debian 127.0.0.1 ssh /usr/sbin/sshd no 141 8. 12/20/2022 11:31:30 debian 127.0.0.1 ssh /usr/sbin/sshd no 143 9. 12/20/2022 11:31:35 debian 127.0.0.1 ssh /usr/sbin/sshd no 145 ..... ..... # display kind of failure authentication logs root@dlp:~# aureport -au --failed --summary Failed Authentication Summary Report ============================= total acct ============================= 3 debian 3 ubuntu 1 root # display kind of modification of user accounts logs root@dlp:~# aureport -m -i Account Modifications Report ================================================= # date time auid addr term exe acct success event ================================================= 1. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 68 2. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 69 3. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 70 4. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/useradd ? yes 71 5. 12/20/2022 11:30:54 root dlp.srv.world ttyS0 /usr/bin/passwd debian yes 74 # display kind of modification of user accounts logs since this month root@dlp:~# aureport -m -i --start this-month Account Modifications Report ================================================= # date time auid addr term exe acct success event ================================================= 1. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 68 2. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 69 3. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 70 4. 12/20/2022 11:30:47 root dlp.srv.world ttyS0 /usr/sbin/useradd ? yes 71 5. 12/20/2022 11:30:54 root dlp.srv.world ttyS0 /usr/bin/passwd debian yes 74 # display kind of executing logs root@dlp:~# aureport -x -i Executable Report ==================================== # date time exe term host auid event ==================================== 1. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 17 2. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 18 3. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 19 4. 12/20/2022 11:29:48 /usr/lib/systemd/systemd ? ? unset 20 5. 12/20/2022 11:30:29 /usr/bin/login /dev/ttyS0 dlp.srv.world root 23 6. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 26 7. 12/20/2022 11:30:29 /usr/lib/systemd/systemd (none) ? unset 26 8. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 27 9. 12/20/2022 11:30:29 /usr/lib/systemd/systemd (none) ? unset 27 10. 12/20/2022 11:30:29 /usr/lib/systemd/systemd ? ? unset 28 ..... ..... # display kind of executing logs from 2022/12/19 to 2022/12/20 root@dlp:~# aureport -x -i --start 12/19/2022 --end 12/20/2022 Executable Report ==================================== # date time exe term host auid event ==================================== 1. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 17 2. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 18 3. 12/20/2022 11:29:48 /usr/sbin/auditctl (none) ? unset 19 4. 12/20/2022 11:29:48 /usr/lib/systemd/systemd ? ? unset 20 5. 12/20/2022 11:30:29 /usr/bin/login /dev/ttyS0 dlp.srv.world root 23 ..... ..... |
| [2] | Search and Display logs with [ausearch] and [aureport] like follows. |
|
# search and display sudo logs by UserID 1000 root@dlp:~# ausearch -x sudo -ua 1000 | aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 12/20/2022 11:32:39 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo yes 191 2. 12/20/2022 11:34:22 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 277 3. 12/20/2022 11:34:26 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 278 4. 12/20/2022 11:34:28 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/sudo no 279 # search and display executing logs by UserID 1001 root@dlp:~# ausearch -ui 1001 | aureport -x -i Executable Report ==================================== # date time exe term host auid event ==================================== 1. 12/20/2022 11:33:56 /usr/bin/sudo /dev/ttyS0 dlp.srv.world debian 252 2. 12/20/2022 11:33:56 /usr/bin/sudo ttyS0 ? debian 252 3. 12/20/2022 11:33:56 /usr/bin/sudo /dev/ttyS0 dlp.srv.world debian 253 4. 12/20/2022 11:33:56 /usr/bin/sudo ttyS0 ? debian 253 5. 12/20/2022 11:33:56 /usr/bin/sudo ttyS0 ? debian 254 6. 12/20/2022 11:33:56 /usr/bin/sudo ttyS0 ? debian 254 7. 12/20/2022 11:33:59 /usr/bin/su /dev/ttyS0 dlp.srv.world debian 255 8. 12/20/2022 11:33:59 /usr/bin/su ttyS0 ? debian 255 ..... ..... |
| Sponsored Link |
|
|