Auditd : Display Summary Logs with aureport2026/06/11 |
|
It's possible to display Audit logs summarily with [aureport] command that is included in Audit package. |
|
| [1] | This is how to use [aureport] command. |
|
# display whole summary without arguments root@dlp:~# aureport Summary Report ====================== Range of time in logs: 06/11/26 00:34:54.095 - 06/11/26 00:47:20.805 Selected time for report: 06/11/26 00:34:54 - 06/11/26 00:47:20.805 Number of changes in configuration: 3 Number of changes to accounts, groups, or roles: 5 Number of logins: 3 Number of failed logins: 4 Number of authentications: 8 Number of failed authentications: 4 Number of users: 4 Number of terminals: 7 Number of host names: 3 Number of executables: 12 Number of commands: 5 Number of files: 0 Number of AVC's: 0 Number of MAC events: 0 Number of failed syscalls: 0 Number of anomaly events: 0 Number of responses to anomaly events: 0 Number of crypto events: 0 Number of integrity events: 0 Number of virt events: 0 Number of keys: 0 Number of process IDs: 21 Number of events: 136 # display kind of authentication logs root@dlp:~# aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 06/11/26 00:40:34 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login no 220 2. 06/11/26 00:40:42 debian dlp.srv.world /dev/ttyS0 /usr/bin/login no 224 3. 06/11/26 00:40:48 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login no 226 4. 06/11/26 00:40:55 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/login yes 228 5. 06/11/26 00:41:00 root dlp.srv.world /dev/ttyS0 /usr/bin/su yes 241 6. 06/11/26 00:41:46 ubuntu dlp.srv.world /dev/ttyS0 /usr/bin/su yes 245 7. 06/11/26 00:42:09 ubuntu dlp.srv.world /dev/ttyS0 /usr/lib/cargo/bin/sudo yes 249 8. 06/11/26 00:44:35 root dlp.srv.world ttyS0 /usr/bin/chfn yes 264 9. 06/11/26 00:44:42 debian dlp.srv.world /dev/ttyS0 /usr/bin/su yes 267 10. 06/11/26 00:47:00 debian 127.0.0.1 ssh /usr/lib/openssh/sshd-session no 278 ..... ..... # display kind of failure authentication logs root@dlp:~# aureport -au --failed --summary Failed Authentication Summary Report ============================= total acct ============================= 6 resolute 2 ubuntu 2 debian # display kind of modification of user accounts logs root@dlp:~# aureport -m -i Account Modifications Report ================================================= # date time auid addr term exe acct success event ================================================= 1. 06/11/26 00:44:31 ubuntu dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 260 2. 06/11/26 00:44:31 ubuntu dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 261 3. 06/11/26 00:44:31 ubuntu dlp.srv.world ttyS0 /usr/sbin/useradd debian yes 262 4. 06/11/26 00:44:35 ubuntu dlp.srv.world ttyS0 /usr/bin/passwd debian yes 263 5. 06/11/26 00:44:37 ubuntu dlp.srv.world ttyS0 /usr/bin/gpasswd ubuntu,debian yes 266 6. 06/11/26 00:50:26 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 342 7. 06/11/26 00:50:26 root dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 343 8. 06/11/26 00:50:26 root dlp.srv.world ttyS0 /usr/sbin/useradd resolute yes 344 9. 06/11/26 00:50:31 root dlp.srv.world ttyS0 /usr/bin/passwd resolute yes 345 10. 06/11/26 00:50:34 root dlp.srv.world ttyS0 /usr/bin/gpasswd ubuntu,debian,resolute yes 348 ..... ..... # display kind of modification of user accounts logs since this month root@dlp:~# aureport -m -i --start this-month Account Modifications Report ================================================= # date time auid addr term exe acct success event ================================================= 1. 06/11/26 00:44:31 ubuntu dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 260 2. 06/11/26 00:44:31 ubuntu dlp.srv.world ttyS0 /usr/sbin/groupadd ? yes 261 3. 06/11/26 00:44:31 ubuntu dlp.srv.world ttyS0 /usr/sbin/useradd debian yes 262 4. 06/11/26 00:44:35 ubuntu dlp.srv.world ttyS0 /usr/bin/passwd debian yes 263 5. 06/11/26 00:44:37 ubuntu dlp.srv.world ttyS0 /usr/bin/gpasswd ubuntu,debian yes 266 ..... ..... # display kind of executing logs root@dlp:~# aureport -x -i Executable Report ==================================== # date time exe term host auid event ==================================== 1. 06/11/26 00:34:54 /usr/lib/systemd/systemd ? ? unset 207 2. 06/11/26 00:34:54 /usr/sbin/auditctl (none) ? unset 208 3. 06/11/26 00:34:54 /usr/sbin/auditctl (none) ? unset 209 4. 06/11/26 00:34:54 /usr/sbin/auditctl (none) ? unset 210 5. 06/11/26 00:34:54 /usr/lib/systemd/systemd ? ? unset 211 6. 06/11/26 00:34:54 /usr/lib/systemd/systemd ? ? unset 212 7. 06/11/26 00:36:57 /usr/lib/systemd/systemd ? ? unset 213 8. 06/11/26 00:36:57 /usr/lib/systemd/systemd ? ? unset 214 9. 06/11/26 00:39:59 /usr/lib/systemd/systemd ? ? unset 215 10. 06/11/26 00:40:30 /usr/bin/login /dev/ttyS0 dlp.srv.world root 216 ..... ..... # display kind of executing logs from 2026/06/11 to 2026/06/12 root@dlp:~# aureport -x -i --start 06/11/26 --end 06/12/26 Executable Report ==================================== # date time exe term host auid event ==================================== 1. 06/11/26 00:34:54 /usr/lib/systemd/systemd ? ? unset 207 2. 06/11/26 00:34:54 /usr/sbin/auditctl (none) ? unset 208 3. 06/11/26 00:34:54 /usr/sbin/auditctl (none) ? unset 209 4. 06/11/26 00:34:54 /usr/sbin/auditctl (none) ? unset 210 5. 06/11/26 00:34:54 /usr/lib/systemd/systemd ? ? unset 211 6. 06/11/26 00:34:54 /usr/lib/systemd/systemd ? ? unset 212 7. 06/11/26 00:36:57 /usr/lib/systemd/systemd ? ? unset 213 8. 06/11/26 00:36:57 /usr/lib/systemd/systemd ? ? unset 214 9. 06/11/26 00:39:59 /usr/lib/systemd/systemd ? ? unset 215 10. 06/11/26 00:40:30 /usr/bin/login /dev/ttyS0 dlp.srv.world root 216 ..... ..... |
| [2] | Search and Display logs with [ausearch] and [aureport] like follows. |
|
# search and display sudo logs by UserID 1000 root@dlp:~# ausearch -x sudo -ua 1000 | aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 06/11/26 00:42:09 ubuntu dlp.srv.world /dev/ttyS0 /usr/lib/cargo/bin/sudo yes 249 2. 06/11/26 00:54:31 ubuntu dlp.srv.world /dev/ttyS0 /usr/lib/cargo/bin/sudo yes 422 # search and display executing logs by UserID 1001 root@dlp:~# ausearch -ui 1001 | aureport -x -i Executable Report ==================================== # date time exe term host auid event ==================================== 1. 06/11/26 00:55:19 /usr/bin/su /dev/ttyS0 dlp.srv.world debian 448 2. 06/11/26 00:55:19 /usr/bin/su /dev/ttyS0 dlp.srv.world debian 449 3. 06/11/26 00:55:19 /usr/bin/su /dev/ttyS0 dlp.srv.world debian 450 4. 06/11/26 00:55:19 /usr/bin/su /dev/ttyS0 dlp.srv.world debian 451 5. 06/11/26 00:55:28 /usr/bin/su /dev/ttyS0 dlp.srv.world debian 452 6. 06/11/26 00:55:28 /usr/bin/su /dev/ttyS0 dlp.srv.world debian 453 ..... ..... |
| Sponsored Link |
|
|