Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [auditd]

auditd is the userspace component to the Linux Auditing System.

The auditd subsystem was developed by Steve Grubb and is used to write out audit records generated, generally within kernel space. It allows for monitoring, and logging, of such things as arbitrary system calls or filesystem access. The user space portion is also used as the logging engine for SELinux and pam_tty_audit.

161 questions
0
votes
3 answers

How to install auditd from source in Ubuntu?

I want to set up auditd to collect its logs from remote server. I'm using Ubuntu 14.04.3 LTS. This feature seems to be disabled into Ubuntu auditd package. So, I'm going to install it from source. Where do I can download right auditd source…
Valeria
  • 21
  • 1
  • 3
0
votes
0 answers

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in Linux, as audit generates more data in the log. Can…
Arun
  • 83
  • 1
  • 3
  • 12
0
votes
0 answers

Folder keeps getting deleted and I can't find out why

I have a Joomla based website running on CentOS, Apache, PHP, MySQL. I am using plupload file uploader to upload the files. I'm uploading the files to /tmp/uploads directory where they are processed and then moved. For some reason and for the life…
Wasim
  • 145
  • 2
  • 9
0
votes
1 answer

Logging SFTP activity with auditd

I am currently using auditd to log TTY activity for users that are SSH'd into my system. However, SFTP sessions are not logged in this way. Is there a way to log them using auditd or will I need to use a separate logger for SFTP?
Davis Yoshida
  • 113
  • 4
0
votes
2 answers

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset Defaults …
Ignacio Mondino
  • 19
  • 4
0
votes
3 answers

Track any file changes using auditd

I try configure PCI REQ 10.5.5 "Use file integrity monitoring or change detection software on logs" Use auditd for this, rule "auditctl -w /tmp/testfile -p war" works perfectly. But if I try to use stdout redirect on file like "echo "hi" >>…
Asazio
  • 1
  • 1
  • 1
0
votes
1 answer

Logging violations of rules in limits.conf

I am trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system calls related to limits in the limits.conf that…
PaulDaviesC
  • 149
  • 4
0
votes
0 answers

Linux Auditd: Error receiving audit netlink packet (No buffer space available)

I have some Linux servers that are getting errors like the below in the logs... auditd[1074]: Error receiving audit netlink packet (No buffer space available) I know HOW to resolve the issue (tweak the audit buffer setting in audit.rules), but I'm…
Egyas
  • 151
  • 2
  • 10
0
votes
0 answers

How to configure osquery with auditd

Who has expertise on how to work with osquery (or maybe you solved this problem): Based on articles like this one - https://blog.palantir.com/auditing-with-osquery-part-two-configuration-and-implementation-87a8bba0ef48 I understand osquery can be…
Nullbyte42
  • 1
0
votes
1 answer

Audit Log Partition keeps getting corrupted. How to prevent or boot anyway?

I am running RHEL7, and my audit log partition randomly (not often, but often enough to annoy me) gets corrupted, preventing me from booting. How can I either prevent the partition from being corrupted, or ignore it and allow the system to continue…
dberm22
  • 61
  • 6
0
votes
0 answers

Why Firefox is trying to access .bashrc?

This Ubuntu 22.04 installation is fairly new. Why firefox is trying to read .bashrc and many other files. Does this indicate a security breach? [340664.822484] audit: type=1400 audit(1665738538.467:3862): apparmor="DENIED" operation="open"…
chrislamp
  • 1
0
votes
0 answers

Auditd service mysteriously stopped after 2 minutes on Ubuntu

ubuntu:~$ systemctl status auditd ● auditd.service - Security Auditing Service Loaded: loaded (/lib/systemd/system/auditd.service; enabled; vendor preset: enabled) Active: inactive (dead) since Tue 2022-09-27 15:45:46 UTC; 1h 45min ago …
q85ts
  • 1
0
votes
1 answer

Losing Audit Logs When Tracing a Container

As you know, Linux Audit is not installed on Ubuntu Focal by default. I installed it, and my goal is to trace what containers do. I have this seccomp profile: { "defaultAction": "SCMP_ACT_LOG", "architectures": [ …
MoeKav
  • 1
  • 1
0
votes
1 answer

CIS compliant auditd configuration on Red Hat 7/8

We have a large fleet of Red Hat 7/8 systems. We have a requirement to make sure that all systems are CIS compliant. One of the requirement is to not automatically rotate the audit logs. That is, configure the following: max_log_file_action =…
Jigar
  • 91
  • 2
  • 6
0
votes
1 answer

How to install `aide` without `aide-common` in debian?

Per this post, Newer versions of Ubuntu (including 14.04) come with two packages for AIDE: aide, with the aide command and manual page, and little else aide-common, with a wrapper around that command, configuration files with rules, and cron…
kittygirl
  • 945
  • 5
  • 13
  • 33
1 2 3
…
10
11