s0sta
EN NL عربي
Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

ausearch

Search the audit log (/var/log/audit/audit.log): SELinux denials, logins, commands and other kernel audit events.

Niveau
RHCSA-examen
Groep
SELinux en beveiliging
Root nodig
Ja
Pakket
audit

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

The audit daemon writes security events. ausearch filters them by message type (-m AVC for SELinux denials), time (-ts recent = last 10 minutes, today, boot), program, user, file or audit key. -i turns numbers (UIDs, syscalls, times) into names.

Zo schrijf je het

ausearch [OPTION]...

Opties 38

Meest gebruikt

What

-m, --message TYPE[,TYPE]
Message type: AVC, USER_AVC, SELINUX_ERR, USER_LOGIN, USER_AUTH, SYSCALL, EXECVE, MAC_STATUS …
-c, --comm NAME
Program name.
-x, --executable PATH
Program path.
-k, --key KEY
Events of an audit rule with this key.
-f, --file NAME
Events about a file.
-p, --pid PID
Process ID.
-pp, --ppid PID
Parent process ID.
-sc, --syscall NAME
System call.
-sv, --success yes|no
Only successful / failed events.
-e, --exit CODE
Exit code or errno.
-a, --event ID
One event by ID.

Who

-ua, --uid-all UID
Any user ID.
-ui, --uid UID
User ID.
-ue, --uid-effective UID
Effective user ID.
-ul, --loginuid ID
The original login user (survives su/sudo).
-ga, --gid-all, -gi, --gid, -ge, --gid-effective GID
Group IDs.
-hn, --host NAME
Remote host.
-tm, --terminal TERM
Terminal.
--session ID
Login session.
-se, --context CONTEXT
SELinux context (subject or object).
-su, --subject CONTEXT
Subject context.
-o, --object CONTEXT
Object context.

When

-ts, --start [DATE] [TIME]
From: recent, now, today, yesterday, this-week, boot …
-te, --end [DATE] [TIME]
Until.

Output and input

-i, --interpret
Translate numbers into names.
-r, --raw
Raw log lines (for audit2allow).
--format raw|default|interpret|csv|text
Output format.
--extra-keys, --extra-labels, --extra-obj2, --extra-time
Extra CSV fields.
-w, --word
Match whole words only.
--just-one
Stop after the first event.
-l, --line-buffered
Flush output after each line.
-if, --input FILE|DIR
Read another log file or folder.
--input-logs
Use the log files from auditd.conf.
--checkpoint FILE
Continue where the last search stopped.
--eoe-timeout SECONDS, --escape OPTION, --arch CPU, -n, --node NAME, -vm, -uu
Special filters.
--debug
Debug output.
-h, --help
Show help.
-v, --version
Show the version.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

  1. 1Recent SELinux denials

    ausearch -m AVC -ts recent

    Last 10 minutes.

  2. 2Denials of one program today

    ausearch -m AVC -c httpd -ts today -i

    -i gives readable names and times.

  3. 3Since the last boot

    ausearch -m AVC,USER_AVC,SELINUX_ERR -ts boot

    All SELinux problems of this boot.

  4. 4Explain the denials

    ausearch -m AVC -ts recent | audit2why

    Says if a label, boolean or missing rule is the cause.

  5. 5Failed logins (security)

    ausearch -m USER_LOGIN -sv no -ts today -i

    Who failed to log in, from where.

  6. 6Who really did it (after sudo)

    ausearch -ul 1001 -ts today -i | less

    loginuid stays the original user.

  7. 7Watch a file with an audit rule

    auditctl -w /etc/passwd -p wa -k passwd_changes
ausearch -k passwd_changes -i

    Every write to /etc/passwd with user and program.

  8. 8SELinux mode changes

    ausearch -m MAC_STATUS -ts this-week -i

    Who ran setenforce.

  9. 9Commands run as root

    ausearch -m EXECVE -ts today -i | grep -i 'a0=' | head

    Needs audit rules for execve.

  10. 10Summary reports

    aureport --avc --summary
aureport -au -ts today

    Counts instead of single events.

Bestanden

/var/log/audit/audit.log
The audit log.
/etc/audit/rules.d/
Audit rules.
/etc/audit/auditd.conf
auditd settings.

Exitcodes

0Events found.
1Nothing found or error.

Volledige handleiding

Deze pagina legt het commando uit in eenvoudige woorden. De originele handleiding heeft elk detail.

In je terminal: man 8 ausearch

Open de man-pagina (linux.die.net)man7.org