how to extracting only few records from audit.log The 2019 Stack Overflow Developer Survey Results Are In Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) 2019 Community Moderator Election ResultsHow to log all the system calls made by a program, say chrome, using linux auditing?How to log all system calls made by a process and all its descendants with auditdHow to disable sudo related logging for successful command execution under CentOS/Fedora?How can I forward only errors from the audit log to rsyslog server?How to disable useless “audit success” log entries in dmesgHow to exclude auditd messages from dmesg and only log them in /var/log/audit.logUndocumented format of Linux Audit log recordsHow can I get auditd to report on ONLY the rules I specify with auditctl? (Linux)How do I differentiate between, xterm and firefox, if both call syscall=socketcall(recvmsg)auditctl -l shows only few rules
Why doesn't shell automatically fix "useless use of cat"?
What do I do when my TA workload is more than expected?
Could an empire control the whole planet with today's comunication methods?
Didn't get enough time to take a Coding Test - what to do now?
My body leaves; my core can stay
should truth entail possible truth
Circular reasoning in L'Hopital's rule
Can the Right Ascension and Argument of Perigee of a spacecraft's orbit keep varying by themselves with time?
Do working physicists consider Newtonian mechanics to be "falsified"?
How to determine omitted units in a publication
Windows 10: How to Lock (not sleep) laptop on lid close?
Why doesn't a hydraulic lever violate conservation of energy?
Word for: a synonym with a positive connotation?
Can withdrawing asylum be illegal?
What's the point in a preamp?
What is the padding with red substance inside of steak packaging?
Did the UK government pay "millions and millions of dollars" to try to snag Julian Assange?
Is every episode of "Where are my Pants?" identical?
How do you keep chess fun when your opponent constantly beats you?
What was the last x86 CPU that did not have the x87 floating-point unit built in?
Why did Peik Lin say, "I'm not an animal"?
Make it rain characters
Why can't wing-mounted spoilers be used to steepen approaches?
Intergalactic human space ship encounters another ship, character gets shunted off beyond known universe, reality starts collapsing
how to extracting only few records from audit.log
The 2019 Stack Overflow Developer Survey Results Are In
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern)
2019 Community Moderator Election ResultsHow to log all the system calls made by a program, say chrome, using linux auditing?How to log all system calls made by a process and all its descendants with auditdHow to disable sudo related logging for successful command execution under CentOS/Fedora?How can I forward only errors from the audit log to rsyslog server?How to disable useless “audit success” log entries in dmesgHow to exclude auditd messages from dmesg and only log them in /var/log/audit.logUndocumented format of Linux Audit log recordsHow can I get auditd to report on ONLY the rules I specify with auditctl? (Linux)How do I differentiate between, xterm and firefox, if both call syscall=socketcall(recvmsg)auditctl -l shows only few rules
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed at shell).
Audit.log as follows:
> type=SYSCALL msg=audit(1554390377.124:5): arch=40000003 syscall=11
> success=yes exit=0 a0=810cf88 a1=810bd88 a2=80f5008 a3=810bd88 items=2
> ppid=9991 pid=10497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="date"
> exe="/bin/busybox.nosuid" key=(null)
> type=EXECVE msg=audit(1554390377.124:5): argc=2 a0="date" a1="+%m%d%y-%H:%M:%S:%N"
> type=CWD msg=audit(1554390377.124:5): cwd="/" type=PATH
> msg=audit(1554390377.124:5): item=0 name="/bin/date" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
>
> type=PATH msg=audit(1554390377.124:5): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=SYSCALL msg=audit(1554390389.524:36): arch=40000003 syscall=11
> success=yes exit=0 a0=80f68a8 a1=80f6ae8 a2=80f3008 a3=80f6ae8 items=2
> ppid=9906 pid=10592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="cat"
> exe="/bin/busybox.nosuid" key=(null)
> type=EXECVE
> msg=audit(1554390389.524:36): argc=2 a0="cat" a1="/tmp/cpuinfo"
> type=CWD msg=audit(1554390389.524:36): cwd="/"
> type=PATH
> msg=audit(1554390389.524:36): item=0 name="/bin/cat" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=PATH msg=audit(1554390389.524:36): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
In the above log,
I want only records where tty=pts*, I have tried egrep but I am not getting the output as expected.
egrep "tty=pts*|type=EXECVE" audit.log
Expected output:
type=EXECVE msg=audit(1554390389.524:36): argc=2 a0="cat"
a1="/tmp/cpuinfo"
I want only the records with tty=pts[0-6] (excluding tty=none).
linux audit linux-audit
asked Apr 9 at 7:20
fox18fox18
54
add a comment |
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed at shell).
Audit.log as follows:
> type=SYSCALL msg=audit(1554390377.124:5): arch=40000003 syscall=11
> success=yes exit=0 a0=810cf88 a1=810bd88 a2=80f5008 a3=810bd88 items=2
> ppid=9991 pid=10497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="date"
> exe="/bin/busybox.nosuid" key=(null)
> type=EXECVE msg=audit(1554390377.124:5): argc=2 a0="date" a1="+%m%d%y-%H:%M:%S:%N"
> type=CWD msg=audit(1554390377.124:5): cwd="/" type=PATH
> msg=audit(1554390377.124:5): item=0 name="/bin/date" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
>
> type=PATH msg=audit(1554390377.124:5): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=SYSCALL msg=audit(1554390389.524:36): arch=40000003 syscall=11
> success=yes exit=0 a0=80f68a8 a1=80f6ae8 a2=80f3008 a3=80f6ae8 items=2
> ppid=9906 pid=10592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="cat"
> exe="/bin/busybox.nosuid" key=(null)
> type=EXECVE
> msg=audit(1554390389.524:36): argc=2 a0="cat" a1="/tmp/cpuinfo"
> type=CWD msg=audit(1554390389.524:36): cwd="/"
> type=PATH
> msg=audit(1554390389.524:36): item=0 name="/bin/cat" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=PATH msg=audit(1554390389.524:36): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
In the above log,
I want only records where tty=pts*, I have tried egrep but I am not getting the output as expected.
egrep "tty=pts*|type=EXECVE" audit.log
Expected output:
type=EXECVE msg=audit(1554390389.524:36): argc=2 a0="cat"
a1="/tmp/cpuinfo"
I want only the records with tty=pts[0-6] (excluding tty=none).
linux audit linux-audit
asked Apr 9 at 7:20
fox18fox18
54
are you sure you're not interested in including thecwdfrom thetype=CWDstanza, in case the command has any relative elements?
– Jeff Schaller♦
2 days ago
I do not want type=cwd,I need only type=EXECVE as it records the shell commands but the problem is it also records tty=(none) background process. I need to exclude that in either way adding rule to audit.rules.
– fox18
2 days ago
add a comment |
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed at shell).
Audit.log as follows:
> type=SYSCALL msg=audit(1554390377.124:5): arch=40000003 syscall=11
> success=yes exit=0 a0=810cf88 a1=810bd88 a2=80f5008 a3=810bd88 items=2
> ppid=9991 pid=10497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="date"
> exe="/bin/busybox.nosuid" key=(null)
> type=EXECVE msg=audit(1554390377.124:5): argc=2 a0="date" a1="+%m%d%y-%H:%M:%S:%N"
> type=CWD msg=audit(1554390377.124:5): cwd="/" type=PATH
> msg=audit(1554390377.124:5): item=0 name="/bin/date" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
>
> type=PATH msg=audit(1554390377.124:5): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=SYSCALL msg=audit(1554390389.524:36): arch=40000003 syscall=11
> success=yes exit=0 a0=80f68a8 a1=80f6ae8 a2=80f3008 a3=80f6ae8 items=2
> ppid=9906 pid=10592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="cat"
> exe="/bin/busybox.nosuid" key=(null)
> type=EXECVE
> msg=audit(1554390389.524:36): argc=2 a0="cat" a1="/tmp/cpuinfo"
> type=CWD msg=audit(1554390389.524:36): cwd="/"
> type=PATH
> msg=audit(1554390389.524:36): item=0 name="/bin/cat" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=PATH msg=audit(1554390389.524:36): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
In the above log,
I want only records where tty=pts*, I have tried egrep but I am not getting the output as expected.
egrep "tty=pts*|type=EXECVE" audit.log
Expected output:
type=EXECVE msg=audit(1554390389.524:36): argc=2 a0="cat"
a1="/tmp/cpuinfo"
I want only the records with tty=pts[0-6] (excluding tty=none).
linux audit linux-audit
asked Apr 9 at 7:20
fox18fox18
54
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed at shell).
Audit.log as follows:
> type=SYSCALL msg=audit(1554390377.124:5): arch=40000003 syscall=11
> success=yes exit=0 a0=810cf88 a1=810bd88 a2=80f5008 a3=810bd88 items=2
> ppid=9991 pid=10497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="date"
> exe="/bin/busybox.nosuid" key=(null)
> type=EXECVE msg=audit(1554390377.124:5): argc=2 a0="date" a1="+%m%d%y-%H:%M:%S:%N"
> type=CWD msg=audit(1554390377.124:5): cwd="/" type=PATH
> msg=audit(1554390377.124:5): item=0 name="/bin/date" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
>
> type=PATH msg=audit(1554390377.124:5): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=SYSCALL msg=audit(1554390389.524:36): arch=40000003 syscall=11
> success=yes exit=0 a0=80f68a8 a1=80f6ae8 a2=80f3008 a3=80f6ae8 items=2
> ppid=9906 pid=10592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="cat"
> exe="/bin/busybox.nosuid" key=(null)
> type=EXECVE
> msg=audit(1554390389.524:36): argc=2 a0="cat" a1="/tmp/cpuinfo"
> type=CWD msg=audit(1554390389.524:36): cwd="/"
> type=PATH
> msg=audit(1554390389.524:36): item=0 name="/bin/cat" inode=1538
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
> type=PATH msg=audit(1554390389.524:36): item=1 name=(null) inode=969
> dev=b3:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
In the above log,
I want only records where tty=pts*, I have tried egrep but I am not getting the output as expected.
egrep "tty=pts*|type=EXECVE" audit.log
Expected output:
type=EXECVE msg=audit(1554390389.524:36): argc=2 a0="cat"
a1="/tmp/cpuinfo"
I want only the records with tty=pts[0-6] (excluding tty=none).
linux audit linux-audit
linux audit linux-audit
asked Apr 9 at 7:20
fox18fox18
54
asked Apr 9 at 7:20
fox18fox18
54
edited Apr 9 at 9:02
fox18
asked Apr 9 at 7:20
fox18fox18
54
asked Apr 9 at 7:20
fox18fox18
54
asked Apr 9 at 7:20
fox18fox18
54
54
are you sure you're not interested in including thecwdfrom thetype=CWDstanza, in case the command has any relative elements?
– Jeff Schaller♦
2 days ago
I do not want type=cwd,I need only type=EXECVE as it records the shell commands but the problem is it also records tty=(none) background process. I need to exclude that in either way adding rule to audit.rules.
– fox18
2 days ago
add a comment |
are you sure you're not interested in including thecwdfrom thetype=CWDstanza, in case the command has any relative elements?
– Jeff Schaller♦
2 days ago
I do not want type=cwd,I need only type=EXECVE as it records the shell commands but the problem is it also records tty=(none) background process. I need to exclude that in either way adding rule to audit.rules.
– fox18
2 days ago
are you sure you're not interested in including the
cwd from the type=CWD stanza, in case the command has any relative elements?– Jeff Schaller♦
2 days ago
are you sure you're not interested in including the
cwd from the type=CWD stanza, in case the command has any relative elements?– Jeff Schaller♦
2 days ago
I do not want type=cwd,I need only type=EXECVE as it records the shell commands but the problem is it also records tty=(none) background process. I need to exclude that in either way adding rule to audit.rules.
– fox18
2 days ago
I do not want type=cwd,I need only type=EXECVE as it records the shell commands but the problem is it also records tty=(none) background process. I need to exclude that in either way adding rule to audit.rules.
– fox18
2 days ago
add a comment |
1 Answer
1
active
oldest
votes
Edited the code as per comment Kindly check
command
awk '/type=EXECVE/||/tty=pts*/print $0' filename
answered Apr 9 at 8:52
Praveen Kumar BSPraveen Kumar BS
1,7621311
I need the type=EXECVE line,because it only stores the commands with arguments.
– fox18
Apr 9 at 9:04
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f511389%2fhow-to-extracting-only-few-records-from-audit-log%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Edited the code as per comment Kindly check
command
awk '/type=EXECVE/||/tty=pts*/print $0' filename
answered Apr 9 at 8:52
Praveen Kumar BSPraveen Kumar BS
1,7621311
I need the type=EXECVE line,because it only stores the commands with arguments.
– fox18
Apr 9 at 9:04
add a comment |
Edited the code as per comment Kindly check
command
awk '/type=EXECVE/||/tty=pts*/print $0' filename
answered Apr 9 at 8:52
Praveen Kumar BSPraveen Kumar BS
1,7621311
I need the type=EXECVE line,because it only stores the commands with arguments.
– fox18
Apr 9 at 9:04
add a comment |
Edited the code as per comment Kindly check
command
awk '/type=EXECVE/||/tty=pts*/print $0' filename
answered Apr 9 at 8:52
Praveen Kumar BSPraveen Kumar BS
1,7621311
Edited the code as per comment Kindly check
command
awk '/type=EXECVE/||/tty=pts*/print $0' filename
answered Apr 9 at 8:52
Praveen Kumar BSPraveen Kumar BS
1,7621311
edited Apr 9 at 9:43
answered Apr 9 at 8:52
Praveen Kumar BSPraveen Kumar BS
1,7621311
answered Apr 9 at 8:52
Praveen Kumar BSPraveen Kumar BS
1,7621311
answered Apr 9 at 8:52
Praveen Kumar BSPraveen Kumar BS
1,7621311
1,7621311
I need the type=EXECVE line,because it only stores the commands with arguments.
– fox18
Apr 9 at 9:04
add a comment |
I need the type=EXECVE line,because it only stores the commands with arguments.
– fox18
Apr 9 at 9:04
I need the type=EXECVE line,because it only stores the commands with arguments.
– fox18
Apr 9 at 9:04
I need the type=EXECVE line,because it only stores the commands with arguments.
– fox18
Apr 9 at 9:04
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f511389%2fhow-to-extracting-only-few-records-from-audit-log%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
are you sure you're not interested in including the
cwdfrom thetype=CWDstanza, in case the command has any relative elements?– Jeff Schaller♦
2 days ago
I do not want type=cwd,I need only type=EXECVE as it records the shell commands but the problem is it also records tty=(none) background process. I need to exclude that in either way adding rule to audit.rules.
– fox18
2 days ago