Questions tagged [auditd]
auditd is the linux operation for writing logs to the Linux Auditing System.
29
questions
1
vote
0
answers
101
views
Selinux policy to allow all access to script or to not log anything done by this script
I have a bash script running every 5 minutes in cron, that basically runs some commands like: mkdir, top, grep, date, wait, sleep, jstack. It runs on user bob.
It generates a lot of logs and I want to ...
- 11
2
votes
0
answers
226
views
How to determine what script is deleting files in Linux?
I run a Plex Media Server (PMS) on a ubuntu 22.04 system. There's been no update to the PMS libraries for a while, and I recently started adding a few movies to the collection. But what I've found ...
- 163
0
votes
1
answer
214
views
auditd not loading plugin on Debian 10
I am trying to load a plugin (laurel) in auditd on Debian 10. It loads and works on Debian 11 but I need it to run on Debian 10. I have the laurel binary in /etc/audit/plugins.d.
When I begin auditd ...
- 3
1
vote
0
answers
119
views
Partition keeps getting corrupted. How to prevent or boot anyway?
I am running RHEL7, and my audit log partition randomly (not often, but often enough to annoy me) gets corrupted, preventing me from booting. How can I either prevent the partition from being ...
- 113
0
votes
0
answers
125
views
How to downgrade or upgrade AuditD on redhat 8
OS version = Red Hat Enterprise Linux release 8.6 (Ootpa)
Kernel version = 4.18.0-425.3.1.el8.x86_64
I can't find a way to upgrade/downgrade auditd or auditctl.
I must change the version of the auditd/...
1
vote
0
answers
38
views
AuditD - right usage and syntax of -q flag in rules
I would like to use -q flag in auditd rule, but the rule with the -q flag is not working or even added into the rules list.
I have rule like this:
-a always,exit -F path=/home/lukashubl/ -q /home/...
- 11
0
votes
1
answer
123
views
include in log elevated sudo users
I'm new here, but I tried looking but couldn't get how to do it...
I have an ec2 linux box.
When a user directly connects to the machine I can view its ssh ip.
Now when a user does sudo -s for example ...
- 3
4
votes
0
answers
429
views
How to get persistent audit logs?
I am currently trying to figure out which application is creating a mysterious socket file called "no" in my home directory. It happens only every few weeks, that is why I have setup auditd ...
12
votes
1
answer
10k
views
How to stop journalctl showing audit logs and only keep it in a file?
I would like to have all auditd logs only in it's own log file and keep my journalctl view less polluted with events that most of the time, are generated by my own actions (single-user/personal ...
- 378
0
votes
1
answer
494
views
CentOS 8 auditd AVC denials message flood caused by denied setuid
Today my CentOS 8 suddenly frozen and not responding to user inputs.
When I tried to login from console, I saw messages like these:
audit: backlog limit exceeded
audit: backlog limit exceeded
audit: ...
- 1
1
vote
1
answer
231
views
How to configure Auditd to see directory name change?
In my /etc/audit/audit.rules, I have the following watch:
-w /some/place/special -p rwxa -k my_key
On my filesystem, I have the following tree:
/some/place/special/foo/test-rename/james/sub-...
- 11
1
vote
1
answer
87
views
RH / OL 6 auditd login user not audited
I want to audit all commands on Linux servers. We all have our own login accounts to do things but sometimes we need root access. That's no problem.
But when logging in with my user my actions aren't ...
- 13
0
votes
0
answers
1k
views
rsyslogd vs auditd? Are they alternatives or complement each other?
I see that both auditd and rsyslogd services are running (on my OpenSuse Leap 15 box). A quick google didn't give a good answer.
Are these services doing the same job? i.e. Could i get rid of one of ...
- 19
1
vote
1
answer
1k
views
auditctl: Syscall name unknown: socket
I have my original Problem discribed here: https://serverfault.com/questions/958571/what-these-dns-queries-means. It's about UDP packets, the origin of which I can not determine. To solve the problem ...
- 23
0
votes
1
answer
494
views
Finding the intermediate hops en route to internet from behind VPN
I'm new to this.
I'm doing an audit for a network, and will be drawing a network diagram for it.
I have got the IP address list using nmap scan, I can see about 5 networks.
The issue I'm facing is ...
- 75
1
vote
1
answer
479
views
Why does `tail -f /var/audit/current | praudit` just print 5 lines and exit immediately?
I want to follow my audit log live so I can watch for events, and pipe it through praudit to make it human readable. All commands below are run as root.
When I run tail -f /var/audit/current | ...
- 111
1
vote
1
answer
3k
views
How to Watch All Directories(Includes All Subdirectories) using Auditd?
Im using a rule in auditd which is:
-w /etc -p wa -k watch_etc
But upon checking the report using ausearch -k watch_etc -ts today | aureport -f -i
I can't seem to find the changes I've made in the ...
- 111
0
votes
0
answers
766
views
How to find the client IP/name from the audit logs
I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this:
In the server side:
time->Tue Jun 12 16:...
- 181
3
votes
1
answer
2k
views
How to enable systemd's journal audit transport?
I have been studying logging on Linux but I have come to a road-block that's got me stuck for the past few days. My goal is to forward logs from two raspberry pi 3's running OpenSUSE Tumbleweed (...
- 53
1
vote
0
answers
154
views
centos7 what is the best value of audit.rules
I am now suffered with audit : backlog limit exceeded.
I found some articles with similar situation and they said adjust audit log count with audit.rules.
Here is my audit.rules
## This file is ...
- 687
0
votes
2
answers
1k
views
Linux Audit Server Reboots
I'm running AuditD on Centos 6.5.
Is there a way to audit server reboots - who and when a server is rebooted? So if I login and run:
sudo reboot
I should see a log entry in /var/log/audit/audit....
- 443
1
vote
1
answer
2k
views
Track down processes that connect through tcp (on certain ports) using auditd (in GNU/Linux)
I'd like to track down processes that tries to connect to a certain port (on remote host).
So, I discovered that auditd is very powerful for these kind of tasks. The following command instruct auditd ...
- 11
1
vote
1
answer
993
views
How to fix report timestamps generated by aureport via cron?
I set up two aureport cron jobs the other day:
1 0 * * * /sbin/aureport -ts yesterday 00:00:00 | mailx -r "[email protected]" -s "[Audit report] Summary" "[email protected]"
1 0 * * * /sbin/aureport --...
- 13
0
votes
2
answers
2k
views
Tracking file deletion using auditd without unlink?
I'm working on creating an auditd rule that will track the deletion of files and directories. I have one that often turns up in online searches but I'm not sure it is really all that useful:
-a exit,...
- 151
0
votes
1
answer
1k
views
How do I stop recurring error messages from appearing in messages and auditd.log?
On my CentOS linux machine, in my auditd.conf file, I have set my max_log_file_action=keep_logs.
However, in my /var/log/messages and /var/log/auditd.log, the following message appears multiple times ...
- 101
1
vote
0
answers
377
views
how to record all who that login to my linux machines and records them
I installed the package audit on my linux red-hat 6.x machine
in order to view the recored of each user that log to my linux machine
yum install audit
kit installation from: https://access.redhat....
- 489
0
votes
2
answers
2k
views
How can I make cron to email report audit only if there is something to report?
I setup daily cron job checking if files have changed previous day, since those files are not suppose to changed i'm getting empty report, how can i change it to send email prevent this.
this is my ...
- 113
0
votes
1
answer
3k
views
auditctl -l not showing rules
I have some rules in the audit.conf file. When do auditctl -l, they don't show up. If I restart the auditd service and do auditctl -l again, then the rules show up. Any idea why this? Where can I ...
- 170
2
votes
2
answers
4k
views
Auditd - auditctl rule to monitor dir only (not all sub dir and files etc..)
I am trying to use auditd to monitor changes to a directory.
The problem is that when I setup a rule, it monitors the directory I specified, but also all the subdirectories and files underneath it, ...
- 281