7.6. Understanding Audit Log Files Red Hat Enterprise Linux 6

Language:
Format:

Language:
Format:

Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

By default, the Audit system stores log entries in the /var/log/audit/audit.log file; if log rotation is enabled, rotated audit.log files are stored in the same directory.

The following Audit rule logs every attempt to read or modify the /etc/ssh/sshd_config file:

-w /etc/ssh/sshd_config -p warx -k sshd_config

If the auditd daemon is running, running the following command creates a new event in the Audit log file:

~]#cat /etc/ssh/sshd_config

This event in the audit.log file looks as follows:

First Record

type=SYSCALL

The type field contains the type of the record. In this example, the SYSCALL value specifies that this record was triggered by a system call to the kernel.

For a list of all possible type values and their explanations, see SectionB.2, “Audit Record Types”.

msg=audit(1364481363.243:24287):

The msg field records:

a time stamp and a unique ID of the record in the form audit(time_stamp:ID). Multiple records can share the same time stamp and ID if they were generated as part of the same Audit event.
various event-specific name=value pairs provided by the kernel or user space applications.

arch=c000003e

The arch field contains information about the CPU architecture of the system. The value, c000003e, is encoded in hexadecimal notation. When searching Audit records with the ausearch command, use the -i or --interpret option to automatically convert hexadecimal values into their human-readable equivalents. The c000003e value is interpreted as x86_64.

syscall=2

The syscall field records the type of the system call that was sent to the kernel. The value, 2, can be matched with its human-readable equivalent in the /usr/include/asm/unistd_64.h file. In this case, 2 is the open system call. Note that the ausyscall utility allows you to convert system call numbers to their human-readable equivalents. Use the ausyscall --dump command to display a listing of all system calls along with their numbers. For more information, see the ausyscall(8) man page.

success=no

The success field records whether the system call recorded in that particular event succeeded or failed. In this case, the call did not succeed.

exit=-13

The exit field contains a value that specifies the exit code returned by the system call. This value varies for different system call. You can interpret the value to its human-readable equivalent with the following command: ausearch --interpret --exit -13 (assuming your Audit log contains an event that failed with exit code -13).

a0=7fffd19c5592, a1=0, a2=7fffd19c5592, a3=a

The a0 to a3 fields record the first four arguments, encoded in hexadecimal notation, of the system call in this event. These arguments depend on the system call that is used; they can be interpreted by the ausearch utility.

items=1

The items field contains the number of path records in the event.

ppid=2686

The ppid field records the Parent Process ID (PPID). In this case, 2686 was the PPID of the bash process.

pid=3538

The pid field records the Process ID (PID). In this case, 3538 was the PID of the cat process.

auid=500

The auid field records the Audit user ID, that is the loginuid. This ID is assigned to a user upon login and is inherited by every process even when the user's identity changes (for example, by switching user accounts with the su - john command).

Second Record

type=CWD

In the second record, the type field value is CWD — current working directory. This type is used to record the working directory from which the process that invoked the system call specified in the first record was executed.

The purpose of this record is to record the current process's location in case a relative path is captured in the associated PATH record. This way the absolute path can be reconstructed.

msg=audit(1364481363.243:24287)

The msg field holds the same time stamp and ID value as the value in the first record.

cwd="/home/shadowman"

The cwd field contains the path to the directory in which the system call was invoked.

Third Record

type=PATH

In the third record, the type field value is PATH. An Audit event contains a PATH-type record for every path that is passed to the system call as an argument. In this Audit event, only one path (/etc/ssh/sshd_config) was used as an argument.

msg=audit(1364481363.243:24287):

The msg field holds the same time stamp and ID value as the value in the first and second record.

item=0

The item field indicates which item, of the total number of items referenced in the SYSCALL type record, the current record is. This number is zero-based; a value of 0 means it is the first item.

name="/etc/ssh/sshd_config"

The name field records the path of the file or directory that was passed to the system call as an argument. In this case, it was the /etc/ssh/sshd_config file.

inode=409248

The inode field contains the inode number associated with the file or directory recorded in this event. The following command displays the file or directory that is associated with the 409248 inode number:

~]#find / -inum 409248 -print/etc/ssh/sshd_config

dev=fd:00

The dev field specifies the minor and major ID of the device that contains the file or directory recorded in this event. In this case, the value represents the /dev/fd/0 device.

mode=0100600

The mode field records the file or directory permissions, encoded in numerical notation. In this case, 0100600 can be interpreted as -rw-------, meaning that only the root user has read and write permissions to the /etc/ssh/sshd_config file.

ouid=0

The ouid field records the object owner's user ID.

ogid=0

The ogid field records the object owner's group ID.

rdev=00:00

The rdev field contains a recorded device identifier for special files only. In this case, it is not used as the recorded file is a regular file.

obj=system_u:object_r:etc_t:s0

The obj field records the SELinux context with which the recorded file or directory was labeled at the time of execution.

The Audit event analyzed above contains only a subset of all possible fields that an event can contain. For a list of all event fields and their explanation, see SectionB.1, “Audit Event Fields”. For a list of all event types and their explanation, see SectionB.2, “Audit Record Types”.

Example7.5.Additional audit.log events

The following Audit event records a successful start of the auditd daemon. The ver field shows the version of the Audit daemon that was started.

type=DAEMON_START msg=audit(1363713609.192:5426): auditd start, ver=2.2 format=raw kernel=2.6.32-358.2.1.el6.x86_64 auid=500 pid=4979 subj=unconfined_u:system_r:auditd_t:s0 res=success

The following Audit event records a failed attempt of user with UID of 500 to log in as the root user.

type=USER_AUTH msg=audit(1364475353.159:24270): user pid=3280 uid=500 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=failed'

7.6. Understanding Audit Log Files Red Hat Enterprise Linux 6 | Red Hat Customer Portal (2024)

FAQs

How to read Audit Log file in Linux? ›

The ausearch utility allows you to search Audit log files for specific events. By default, ausearch searches the /var/log/audit/audit. log file. You can specify a different file using the ausearch options -if file_name command.

Read On ›

How to check logs in redhat Linux? ›

A list of log files maintained by rsyslogd can be found in the /etc/rsyslog. conf configuration file. Most log files are located in the /var/log/ directory. Some applications such as httpd and samba have a directory within /var/log/ for their log files.

Discover More Details ›

Where are the audit logs in RHEL 7? ›

By default, the Audit system stores log entries in the /var/log/audit/audit. log file; if log rotation is enabled, rotated audit. log files are stored in the same directory.

What is an Audit Log file? ›

Audit logging is the process of documenting activity within the software systems used across your organization. Audit logs record the occurrence of an event, the time at which it occurred, the responsible user or service, and the impacted entity.

See Details ›

What is audit log file in Linux? ›

The Linux Audit system provides fine-grained logging of security-related events, known as Linux audit logs. It is enabled by creating Linux auditing rules that specify which events to log. For example, you can add rules to audit: Access to a specific file or directory. Specific system calls.

Find Out More ›

Where are the log files in redhat? ›

log , while Red Hat and CentOS use /var/log/secure . /var/log/kern. log stores kernel events, errors, and warning logs, which are particularly helpful for troubleshooting custom kernels. /var/log/cron stores information about scheduled tasks (cron jobs).

Tell Me More ›

How to read log files? ›

The data contained in these files are usually regular text files. You can read a LOG file with a text editor, like Windows Notepad. For more options, check out this Best Free Text Editors list. You might be able to open one in your web browser, too, via drag-and-drop.

Show Me More ›

What is logs in redhat? ›

Log files are files that contain messages about the system, including the kernel, services, and applications running on it. There are different log files for different information. For example, there is a default system log file, a log file just for security messages, and a log file for cron tasks.

Explore More ›

Where are Linux audit logs stored? ›

By default, the Audit system stores log entries in the /var/log/audit/audit. log file; if log rotation is enabled, rotated audit. log files are stored in the same directory.

What is auditd redhat? ›

auditd or Linux Audit Daemon is a user-space component of the Linux Auditing System, responsible for collecting and writing audit log file records to the disk. It is, however, not responsible for viewing the logs, which can be done through ausearch or aureport utilities.

Show Me More ›

What is the command for audit log? ›

Use the catauditlog command to display the in-memory contents of the audit log. Use the dumpauditlog command to reset or clear the contents of the in-memory audit log. The contents of the audit log are sent to a file in the /dumps/audit directory on the current configuration node.

Read The Full Story ›

What are the two types of audit files? ›

The audit team will need to maintain a current file and a permanent file. The current audit file is used to maintain audit documentation specific to the current year and would not necessarily be useful in future audits.

See Details ›

What are the two types of audit logs? ›

There are typically two kinds of audit records, (1) an event-oriented log and (2) a record of every keystroke, often called keystroke monitoring. Event-based logs usually contain records describing system events, application events, or user events.

Get More Info Here ›

How do I view security audit logs? ›

The security log records each event as defined by the audit policies you set on each object. Open Event Viewer. In the console tree, expand Windows Logs, and then click Security. The results pane lists individual security events.

How do I view folder audit logs? ›

To view this audit log, go to the Event Viewer. Under Windows Logs, select Security. You can find all the audit logs in the middle pane as displayed below. Search the Security Windows Logs for the event ID 4656 with the Audit Failed keyword to find out who tried changing a file or folder.

How to check log activity in Linux? ›

How can I check Linux logs? To access the system directory of a Linux or UNIX-style operating system you will need to tap in the cd command. From here, you can look at system logs using the cd /var/log command. Type ls to bring up the logs in this directory.

View Details ›

7.6. Understanding Audit Log Files Red Hat Enterprise Linux 6 | Red Hat Customer Portal (2024)

Red Hat Training

First Record

Second Record

Third Record

FAQs

How to read Audit Log file in Linux? ›

What is the command for audit log? ›