Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 418 / 450

audit/audit.log
. Not all record types contain the same search phrases. There are
no
hostname
or
uid
entries in a
PATH
record, for example. When searching, make
sure that you choose appropriate search criteria to catch all records you need. On the
other hand, you could be searching for a specific type of record and still get various
other related records along with it. This is caused by different parts of the kernel con-
tributing additional records for events that are related to the one to find. For example,
you would always get a
PATH
record along with the
SYSCALL
record for an
open
system call.
TIP: Using Multiple Search Options
Any of the command line options can be combined with logical AND operators
to narrow down your search.
Read Audit Logs from Another File
When the audit logs have moved to another machine or when you want to analyze
the logs of a number of machines on your local machine without wanting to connect
to each of these individually, move the logs to a local file and have ausearch search
them locally:
ausearch - option -if myfile
Convert Numeric Results into Text
Some information, such as user IDs are printed in numeric form. To convert these
into human readable text format, add the
-i
option to your
ausearch
command.
Search by Audit Event ID
If you have previously run an audit report or done an autrace, you might want to
analyze the trail of a particular event in the log. Most of the report types described
in
Section 30.5, “Understanding the Audit Logs and Generating Reports” (page 391)
include audit event IDs in their output. An audit event ID is the second part of an
audit message ID, which consists of a UNIX epoch time stamp and the audit event
ID separated by a colon. All events that are logged from one application's system
call have the same event ID. Use this event ID with ausearch to retrieve this event's
trail from the log.
The autrace tool asks you to review the complete trail of the command traced in
the logs using ausearch. autrace provides you with the complete ausearch command
including the audit event ID.
404 Security Guide