s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

ausearch

Search the audit log (/var/log/audit/audit.log): SELinux denials, logins, commands and other kernel audit events.

المستوى
امتحان RHCSA
المجموعة
SELinux والأمان
يحتاج root
نعم
الحزمة
audit

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

The audit daemon writes security events. ausearch filters them by message type (-m AVC for SELinux denials), time (-ts recent = last 10 minutes, today, boot), program, user, file or audit key. -i turns numbers (UIDs, syscalls, times) into names.

طريقة الكتابة

ausearch [OPTION]...

الخيارات 38

الأكثر استخدامًا

What

-m, --message TYPE[,TYPE]
Message type: AVC, USER_AVC, SELINUX_ERR, USER_LOGIN, USER_AUTH, SYSCALL, EXECVE, MAC_STATUS …
-c, --comm NAME
Program name.
-x, --executable PATH
Program path.
-k, --key KEY
Events of an audit rule with this key.
-f, --file NAME
Events about a file.
-p, --pid PID
Process ID.
-pp, --ppid PID
Parent process ID.
-sc, --syscall NAME
System call.
-sv, --success yes|no
Only successful / failed events.
-e, --exit CODE
Exit code or errno.
-a, --event ID
One event by ID.

Who

-ua, --uid-all UID
Any user ID.
-ui, --uid UID
User ID.
-ue, --uid-effective UID
Effective user ID.
-ul, --loginuid ID
The original login user (survives su/sudo).
-ga, --gid-all, -gi, --gid, -ge, --gid-effective GID
Group IDs.
-hn, --host NAME
Remote host.
-tm, --terminal TERM
Terminal.
--session ID
Login session.
-se, --context CONTEXT
SELinux context (subject or object).
-su, --subject CONTEXT
Subject context.
-o, --object CONTEXT
Object context.

When

-ts, --start [DATE] [TIME]
From: recent, now, today, yesterday, this-week, boot …
-te, --end [DATE] [TIME]
Until.

Output and input

-i, --interpret
Translate numbers into names.
-r, --raw
Raw log lines (for audit2allow).
--format raw|default|interpret|csv|text
Output format.
--extra-keys, --extra-labels, --extra-obj2, --extra-time
Extra CSV fields.
-w, --word
Match whole words only.
--just-one
Stop after the first event.
-l, --line-buffered
Flush output after each line.
-if, --input FILE|DIR
Read another log file or folder.
--input-logs
Use the log files from auditd.conf.
--checkpoint FILE
Continue where the last search stopped.
--eoe-timeout SECONDS, --escape OPTION, --arch CPU, -n, --node NAME, -vm, -uu
Special filters.
--debug
Debug output.
-h, --help
Show help.
-v, --version
Show the version.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

  1. 1Recent SELinux denials

    ausearch -m AVC -ts recent

    Last 10 minutes.

  2. 2Denials of one program today

    ausearch -m AVC -c httpd -ts today -i

    -i gives readable names and times.

  3. 3Since the last boot

    ausearch -m AVC,USER_AVC,SELINUX_ERR -ts boot

    All SELinux problems of this boot.

  4. 4Explain the denials

    ausearch -m AVC -ts recent | audit2why

    Says if a label, boolean or missing rule is the cause.

  5. 5Failed logins (security)

    ausearch -m USER_LOGIN -sv no -ts today -i

    Who failed to log in, from where.

  6. 6Who really did it (after sudo)

    ausearch -ul 1001 -ts today -i | less

    loginuid stays the original user.

  7. 7Watch a file with an audit rule

    auditctl -w /etc/passwd -p wa -k passwd_changes
ausearch -k passwd_changes -i

    Every write to /etc/passwd with user and program.

  8. 8SELinux mode changes

    ausearch -m MAC_STATUS -ts this-week -i

    Who ran setenforce.

  9. 9Commands run as root

    ausearch -m EXECVE -ts today -i | grep -i 'a0=' | head

    Needs audit rules for execve.

  10. 10Summary reports

    aureport --avc --summary
aureport -au -ts today

    Counts instead of single events.

الملفات

/var/log/audit/audit.log
The audit log.
/etc/audit/rules.d/
Audit rules.
/etc/audit/auditd.conf
auditd settings.

رموز الخروج

0 :: Events found. 1 :: Nothing found or error.

الدليل الكامل

هذه الصفحة تشرح الأمر بكلمات بسيطة. الدليل الأصلي فيه كل التفاصيل.

في الطرفية: man 8 ausearch

افتح صفحة man (linux.die.net)man7.org