Auditd : Search Logs with ausearch2026/06/11 |
|
Some Audit rules are set by default like System Login, Modification of User Accounts, Sudo Actions and so on, there logs are recorded in [/var/log/audit/audit.log]. |
|
| [1] | The logs are text format, so it's possible to see logs directly. |
|
root@dlp:~# tail -5 /var/log/audit/audit.log type=PROCTITLE msg=audit(1781138094.103:210): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573 type=SERVICE_START msg=audit(1781138094.104:211): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=audit-rules comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=SERVICE_STOP msg=audit(1781138094.104:212): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=audit-rules comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=SERVICE_START msg=audit(1781138217.360:213): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=update-notifier-download comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=SERVICE_STOP msg=audit(1781138217.360:214): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=update-notifier-download comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" |
| [2] | Many logs are recorded in [audit.log] and they are complicated, so [ausearch] command is provided by Audit package to search specific logs. |
|
# search USER_LOGIN related logs root@dlp:~# ausearch --message USER_LOGIN --interpret ---- type=USER_LOGIN msg=audit(06/11/26 00:40:36.996:221) : pid=2303 uid=root auid=unset ses=unset subj=unconfined msg='op=login id=ubuntu exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=ttyS0 res=failed' ---- type=USER_LOGIN msg=audit(06/11/26 00:40:45.821:225) : pid=2303 uid=root auid=unset ses=unset subj=unconfined msg='op=login acct=debian exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=ttyS0 res=failed' ---- type=USER_LOGIN msg=audit(06/11/26 00:40:50.937:227) : pid=2303 uid=root auid=unset ses=unset subj=unconfined msg='op=login id=ubuntu exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=ttyS0 res=failed' ---- type=USER_LOGIN msg=audit(06/11/26 00:40:56.167:240) : pid=2303 uid=root auid=ubuntu ses=3 subj=unconfined msg='op=login id=ubuntu exe=/usr/bin/login hostname=dlp.srv.world addr=? terminal=ttyS0 res=success' ..... ..... # search sudo actions by userID 1000 root@dlp:~# ausearch -x sudo -ua 1000 ---- time->Thu Jun 11 00:42:09 2026 type=USER_AUTH msg=audit(1781138529.288:249): pid=2537 uid=1000 auid=1000 ses=3 subj=unconfined msg='op=PAM:authentication grantors=pam_permit,pam_cap acct="ubuntu" exe="/usr/lib/cargo/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Thu Jun 11 00:42:09 2026 type=USER_ACCT msg=audit(1781138529.289:250): pid=2537 uid=1000 auid=1000 ses=3 subj=unconfined msg='op=PAM:accounting grantors=pam_permit acct="ubuntu" exe="/usr/lib/cargo/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Thu Jun 11 00:42:09 2026 type=CRED_REFR msg=audit(1781138529.289:251): pid=2537 uid=1000 auid=1000 ses=3 subj=unconfined msg='op=PAM:setcred grantors=pam_permit,pam_cap acct="root" exe="/usr/lib/cargo/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ---- time->Thu Jun 11 00:42:09 2026 type=USER_START msg=audit(1781138529.289:252): pid=2537 uid=1000 auid=1000 ses=3 subj=unconfined msg='op=PAM:session_open grantors=pam_limits,pam_env,pam_env,pam_permit,pam_umask,pam_unix acct="root" exe="/usr/lib/cargo/bin/sudo" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=success' ..... ..... # search failure events on [dlp.srv.world] root@dlp:~# ausearch --host dlp.srv.world --success no ---- time->Thu Jun 11 00:40:34 2026 type=USER_AUTH msg=audit(1781138434.067:220): pid=2303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct="ubuntu" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- time->Thu Jun 11 00:40:36 2026 type=USER_LOGIN msg=audit(1781138436.996:221): pid=2303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=login id=1000 exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=ttyS0 res=failed' ---- time->Thu Jun 11 00:40:42 2026 type=USER_AUTH msg=audit(1781138442.672:224): pid=2303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct="debian" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=/dev/ttyS0 res=failed' ---- time->Thu Jun 11 00:40:45 2026 type=USER_LOGIN msg=audit(1781138445.821:225): pid=2303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=login acct="debian" exe="/usr/bin/login" hostname=dlp.srv.world addr=? terminal=ttyS0 res=failed' ..... ..... # search logs by a user who has login userID 1000 from 2026/06/11 to 2026/06/12 root@dlp:~# ausearch --start 06/11/26 --end 06/12/26 -ul 1001 ---- time->Thu Jun 11 00:47:07 2026 type=PROCTITLE msg=audit(1781138827.784:283): proctitle=737368642D73657373696F6E3A2064656269616E205B707269765D type=SYSCALL msg=audit(1781138827.784:283): arch=c000003e syscall=1 success=yes exit=4 a0=8 a1=7ffe1edbe070 a2=4 a3=0 items=0 ppid=2824 pid=2826 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="sshd-session" exe="/usr/lib/openssh/sshd-session" subj=unconfined key=(null) type=LOGIN msg=audit(1781138827.784:283): pid=2826 uid=0 subj=unconfined old-auid=4294967295 auid=1001 tty=(none) old-ses=4294967295 ses=5 res=1 ---- time->Thu Jun 11 00:47:07 2026 type=PROCTITLE msg=audit(1781138827.814:287): proctitle="(systemd)" type=SYSCALL msg=audit(1781138827.814:287): arch=c000003e syscall=1 success=yes exit=4 a0=7 a1=7ffd5eb9f740 a2=4 a3=0 items=0 ppid=1 pid=2833 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=6 comm="(systemd)" exe="/usr/lib/systemd/systemd-executor" subj=unconfined key=(null) type=LOGIN msg=audit(1781138827.814:287): pid=2833 uid=0 subj=unconfined old-auid=4294967295 auid=1001 tty=(none) old-ses=4294967295 ses=6 res=1 ---- time->Thu Jun 11 00:47:07 2026 type=USER_START msg=audit(1781138827.815:288): pid=2833 uid=0 auid=1001 ses=6 subj=unconfined msg='op=PAM:session_open grantors=pam_selinux,pam_selinux,pam_loginuid,pam_limits,pam_permit,pam_umask,pam_unix,pam_keyinit,pam_systemd acct="debian" exe="/usr/lib/systemd/systemd-executor" hostname=? addr=? terminal=? res=success' ..... ..... |
| Sponsored Link |
|
|