```php
Linux Audit logs (often inside /var/log/audit/audit.log) provide critical information about various events on a system - enabling administrators to track activities, identify issues, and ensure security compliance. The log entries are categorized by event types specified in the type= field at the beginning of each record.
These logs can be very useful, but also very useless depending on who you ask. They are noisy and log a lot of details, so unless you have some type of filtering and you know what to look for, you will end up on the "useless" category. However, if you take the time to understand them, they can fall into the "usefull" category very easily.
Audit logs in Linux follow a specific format to ensure that all necessary information is recorded in a consistent manner. A typical audit log entry looks like this:
node=hostname1 type=USER_ACCT msg=audit(1476133081.102:283): user pid=9179 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
Here's a breakdown of each part of the log means:
Node
node=hostname1: The node
field indicates the hostname of the machine where the event occurred. In this example, the event happened on a machine named "hostname1". It is not always there and the log can jusr start with the next field.
Type
type=USER_ACCT: The type
field specifies the type of event being recorded. Here, USER_ACCT
indicates a user account-related event.
Message
msg=audit(1476133081.102:283): The msg
field provides a timestamp and a unique identifier for the event. The format is audit(epoch_time:serial_number)
. In this example:
User
user pid=9179 uid=0 auid=4294967295 ses=4294967295: This part includes information about the user and process associated with the event:
Detailed Message
msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)': This part provides a detailed description of the event:
Below is a summary of all currently-supported types of audit records, and what they mean.
type=ADD_GROUP msg=audit(1624300800.123:100): pid=1234 uid=0 auid=1000 ses=2 msg='op=add-group id=1001 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=pts/0 res=success'
type=ADD_USER msg=audit(1624300800.123:101): pid=1234 uid=0 auid=1000 ses=2 msg='op=add-user id=1001 exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/0 res=success'
type=DEL_GROUP msg=audit(1624300800.123:102): pid=1234 uid=0 auid=1000 ses=2 msg='op=delete-group id=1001 exe="/usr/sbin/groupdel" hostname=? addr=? terminal=pts/0 res=success'
type=DEL_USER msg=audit(1624300800.123:103): pid=1234 uid=0 auid=1000 ses=2 msg='op=delete-user id=1001 exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/0 res=success'
type=CHGRP_ID msg=audit(1624300800.123:104): pid=1234 uid=0 auid=1000 ses=2 msg='op=chggrp-id old-id=1001 new-id=1002 exe="/usr/bin/usermod" hostname=? addr=? terminal=pts/0 res=success'
type=CHUSER_ID msg=audit(1624300800.123:105): pid=1234 uid=0 auid=1000 ses=2 msg='op=chguser-id old-id=1001 new-id=1002 exe="/usr/bin/usermod" hostname=? addr=? terminal=pts/0 res=success'
type=ANOM_ABEND msg=audit(1624300800.123:106): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=abend signal=11 comm="example-process" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_ACCESS_FS msg=audit(1624300800.123:107): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=access-fs file="/etc/passwd" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_ADD_ACCT msg=audit(1624300800.123:108): pid=1234 uid=0 auid=1000 ses=2 msg='anomaly=add-acct user="example" exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_AMTU_FAIL msg=audit(1624300800.123:109): pid=1234 uid=0 auid=1000 ses=2 msg='anomaly=amtu-fail test="amtu-test" exe="/usr/sbin/amtu" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_CRYPTO_FAIL msg=audit(1624300800.123:110): pid=1234 uid=0 auid=1000 ses=2 msg='anomaly=crypto-fail operation="encrypt" exe="/usr/bin/crypto" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_DEL_ACCT msg=audit(1624300800.123:111): pid=1234 uid=0 auid=1000 ses=2 msg='anomaly=del-acct user="example" exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_EXEC msg=audit(1624300800.123:112): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=exec file="/usr/bin/example" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_LOGIN_ACCT msg=audit(1624300800.123:113): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=login-acct user="example" exe="/usr/sbin/login" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_LOGIN_FAILURES msg=audit(1624300800.123:114): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=login-failures user="example" exe="/usr/sbin/login" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_LOGIN_LOCATION msg=audit(1624300800.123:115): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=login-location user="example" exe="/usr/sbin/login" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_LOGIN_SESSIONS msg=audit(1624300800.123:116): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=login-sessions user="example" exe="/usr/sbin/login" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_LOGIN_TIME msg=audit(1624300800.123:117): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=login-time user="example" exe="/usr/sbin/login" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_MAX_DAC msg=audit(1624300800.123:118): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=max-dac failures=10 exe="/usr/sbin/daemon" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_MAX_MAC msg=audit(1624300800.123:119): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=max-mac failures=5 exe="/usr/sbin/daemon" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_MK_EXEC msg=audit(1624300800.123:120): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=mk-exec file="/usr/bin/example" exe="/usr/bin/chmod" hostname=? addr=? terminal=pts/0 res=success'
type=ANOM_MOD_ACCT msg=audit(1624300800.123:121): pid=1234 uid=0 auid=1000 ses=2 msg='anomaly=mod-acct user="example" exe="/usr/sbin/usermod" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_PROMISCUOUS msg=audit(1624300800.123:122): pid=1234 uid=0 auid=1000 ses=2 msg='anomaly=promiscuous device="eth0" exe="/usr/sbin/ifconfig" hostname=? addr=? terminal=pts/0 res=success'
type=ANOM_RBAC_FAIL msg=audit(1624300800.123:123): pid=1234 uid=0 auid=1000 ses=2 msg='anomaly=rbac-fail test="self-test" exe="/usr/sbin/rbac-tool" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_RBAC_INTEGRITY_FAIL msg=audit(1624300800.123:124): pid=1234 uid=0 auid=1000 ses=2 msg='anomaly=rbac-integrity-fail file="/etc/rbac.conf" exe="/usr/sbin/rbac-tool" hostname=? addr=? terminal=pts/0 res=failed'
type=ANOM_ROOT_TRANS msg=audit(1624300800.123:125): pid=1234 uid=1000 auid=1000 ses=2 msg='anomaly=root-trans user="example" exe="/usr/bin/su" hostname=? addr=? terminal=pts/0 res=success'
type=AVC msg=audit(1624300800.123:126): pid=1234 uid=0 auid=1000 ses=2 msg='avc: denied { write } for pid=1234 comm="example" name="file" dev="sda1" ino=123456 scontext=system_u:system_r:example_t tcontext=system_u:object_r:example_t tclass=file'
type=AVC_PATH msg=audit(1624300800.123:127): pid=1234 uid=0 auid=1000 ses=2 msg='avc: denied { read } for pid=1234 comm="example" name="file" dev="sda1" ino=123456 scontext=system_u:system_r:example_t tcontext=system_u:object_r:example_t tclass=file'
type=ROLE_ASSIGN msg=audit(1624300800.123:128): pid=1234 uid=0 auid=1000 ses=2 msg='op=role-assign role="example_role" user="example" exe="/usr/sbin/semanage" hostname=? addr=? terminal=pts/0 res=success'
type=ROLE_MODIFY msg=audit(1624300800.123:129): pid=1234 uid=0 auid=1000 ses=2 msg='op=role-modify role="example_role" exe="/usr/sbin/semanage" hostname=? addr=? terminal=pts/0 res=success'
type=ROLE_REMOVE msg=audit(1624300800.123:130): pid=1234 uid=0 auid=1000 ses=2 msg='op=role-remove role="example_role" user="example" exe="/usr/sbin/semanage" hostname=? addr=? terminal=pts/0 res=success'
type=SELINUX_ERR msg=audit(1624300800.123:131): pid=1234 uid=0 auid=1000 ses=2 msg='selinux error: error_number=28 comm="example" exe="/usr/sbin/example" hostname=? addr=? terminal=pts/0 res=failed'
type=CRED_ACQ msg=audit(1624300800.123:132): pid=1234 uid=0 auid=1000 ses=2 msg='op=cred-acq id=1000 exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=CRED_DISP msg=audit(1624300800.123:133): pid=1234 uid=0 auid=1000 ses=2 msg='op=cred-disp id=1000 exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=CRED_REFR msg=audit(1624300800.123:134): pid=1234 uid=0 auid=1000 ses=2 msg='op=cred-refr id=1000 exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=USER_AUTH msg=audit(1624300800.123:135): pid=1234 uid=0 auid=1000 ses=2 msg='op=user-auth user="example" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=USER_LOGIN msg=audit(1624300800.123:136): pid=1234 uid=0 auid=1000 ses=2 msg='op=user-login user="example" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=USER_LOGOUT msg=audit(1624300800.123:137): pid=1234 uid=0 auid=1000 ses=2 msg='op=user-logout user="example" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=USER_ACCT msg=audit(1624300800.123:138): pid=1234 uid=0 auid=1000 ses=2 msg='op=user-acct user="example" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=LOGIN msg=audit(1624300800.123:125): pid=1234 uid=0 auid=1000 ses=2 msg='op=login id=1000 exe="/usr/sbin/login" hostname=? addr=? terminal=pts/0 res=success'
type=CRYPTO_FAILURE_USER msg=audit(1624300800.123:139): pid=1234 uid=0 auid=1000 ses=2 msg='op=crypto-failure-user exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=failed'
type=CRYPTO_KEY_USER msg=audit(1624300800.123:140): pid=1234 uid=0 auid=1000 ses=2 msg='op=crypto-key-user key="key123" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=CRYPTO_LOGIN msg=audit(1624300800.123:141): pid=1234 uid=0 auid=1000 ses=2 msg='op=crypto-login user="officer" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=CRYPTO_LOGOUT msg=audit(1624300800.123:142): pid=1234 uid=0 auid=1000 ses=2 msg='op=crypto-logout user="officer" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=CRYPTO_PARAM_CHANGE_USER msg=audit(1624300800.123:143): pid=1234 uid=0 auid=1000 ses=2 msg='op=crypto-param-change-user param="param123" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=CRYPTO_REPLAY_USER msg=audit(1624300800.123:144): pid=1234 uid=0 auid=1000 ses=2 msg='op=crypto-replay-user attack="replay" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=failed'
type=CRYPTO_SESSION msg=audit(1624300800.123:145): pid=1234 uid=0 auid=1000 ses=2 msg='op=crypto-session id="session123" param="param123" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=CRYPTO_TEST_USER msg=audit(1624300800.123:146): pid=1234 uid=0 auid=1000 ses=2 msg='op=crypto-test-user test="test123" exe="/usr/bin/example" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_ABORT msg=audit(1624300800.123:147): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-abort exe="/usr/sbin/example" hostname=? addr=? terminal=pts/0 res=failed'
type=DAEMON_ACCEPT msg=audit(1624300800.123:148): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-accept remote_addr="192.168.0.1" exe="/usr/sbin/auditd" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_CLOSE msg=audit(1624300800.123:149): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-close remote_addr="192.168.0.1" exe="/usr/sbin/auditd" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_CONFIG msg=audit(1624300800.123:150): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-config file="/etc/audit/auditd.conf" exe="/usr/sbin/auditd" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_END msg=audit(1624300800.123:151): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-end exe="/usr/sbin/auditd" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_RESUME msg=audit(1624300800.123:152): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-resume exe="/usr/sbin/auditd" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_RESTART msg=audit(1624300800.123:153): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-restart exe="/usr/sbin/example" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_ROTATE msg=audit(1624300800.123:154): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-rotate file="/var/log/audit/audit.log" exe="/usr/sbin/auditd" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_START msg=audit(1624300800.123:155): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-start exe="/usr/sbin/auditd" hostname=? addr=? terminal=pts/0 res=success'
type=DAEMON_STOP msg=audit(1624300800.123:156): pid=1234 uid=0 auid=1000 ses=2 msg='op=daemon-stop exe="/usr/sbin/auditd" hostname=? addr=? terminal=pts/0 res=success'
Understanding and analyzing these audit logs can significantly enhance your ability to maintain system security and compliance. Tools like Trunc can automatically parse and help you understand audit logs, making it easier to monitor, manage, and act on the information contained within these logs.