1AUREPORT(8) System Administration Utilities AUREPORT(8)
2
6 aureport - a tool that produces summary reports of audit daemon logs
7
9 aureport [options]
10
12 aureport is a tool that produces summary reports of the audit system
13 logs. The aureport utility can also take input from stdin as long as
14 the input is the raw log data. The reports have a column label at the
15 top to help with interpretation of the various fields. Except for the
16 main summary report, all reports have the audit event number. You can
17 subsequently lookup the full event with ausearch -a event number. You
18 may need to specify start & stop times if you get multiple hits. The
19 reports produced by aureport can be used as building blocks for more
20 complicated analysis.
21
24 -au, --auth
25 Report about authentication attempts
26 -a, --avc
28 Report about avc messages
29 --comm Report about commands run
31 -c, --config
33 Report about config changes
34 -cr, --crypto
36 Report about crypto events
37 --debug
39 Write malformed events that are skipped to stderr.
40 --eoe-timeout seconds
42 Set the end of event parsing timeout. See end_of_event_timeout
43 in auditd.conf(5) for details. Note that setting this value will
44 override any configured value found in /etc/auditd/auditd.conf.
45 -e, --event
47 Report about events
48 --escape option
50 This option determines if the output is escaped to make the con‐
51 tent safer for certain uses. The options are raw , tty , shell ,
52 and shell_quote. Each mode includes the characters of the pre‐
53 ceding mode and escapes more characters. That is to say shell
54 includes all characters escaped by tty and adds more. tty is the
55 default.
56 -f, --file
58 Report about files and af_unix sockets
59 --failed
61 Only select failed events for processing in the reports. The de‐
62 fault is both success and failed events.
63 -h, --host
65 Report about hosts
66 --help Print brief command summary
68 -i, --interpret
70 Interpret numeric entities into text. For example, uid is con‐
71 verted to account name. The conversion is done using the current
72 resources of the machine where the search is being run. If you
73 have renamed the accounts, or don't have the same accounts on
74 your machine, you could get misleading results.
75 -if, --input file | directory
77 Use the given file or directory instead of the logs. This is to
78 aid analysis where the logs have been moved to another machine
79 or only part of a log was saved. The path length is limited to
80 4064 bytes.
81 --input-logs
83 Use the log file location from auditd.conf as input for analy‐
84 sis. This is needed if you are using aureport from a cron job.
85 --integrity
87 Report about integrity events
88 -k, --key
90 Report about audit rule keys
91 -l, --login
93 Report about logins
94 -m, --mods
96 Report about account modifications
97 -ma, --mac
99 Report about Mandatory Access Control (MAC) events
100 -n, --anomaly
102 Report about anomaly events. These events include NIC going into
103 promiscuous mode and programs segfaulting.
104 --node node-name
106 Only select events originating from node name string for pro‐
107 cessing in the reports. The default is to include all nodes.
108 Multiple nodes are allowed.
109 -nc, --no-config
111 Do not include the CONFIG_CHANGE event. This is particularly
112 useful for the key report because audit rules have key labels in
113 many cases. Using this option gets rid of these false positives.
114 -p, --pid
116 Report about processes
117 -r, --response
119 Report about responses to anomaly events
120 -s, --syscall
122 Report about syscalls
123 --success
125 Only select successful events for processing in the reports. The
126 default is both success and failed events.
127 --summary
129 Run the summary report that gives a total of the elements of the
130 main report. Not all reports have a summary.
131 -t, --log
133 This option will output a report of the start and end times for
134 each log.
135 --tty Report about tty keystrokes
137 -te, --end [end-date] [end-time]
139 Search for events with time stamps equal to or before the given
140 end time. The format of end time depends on your locale. If the
141 date is omitted, today is assumed. If the time is omitted, now
142 is assumed. Use 24 hour clock time rather than AM or PM to spec‐
143 ify time. An example date using the en_US.utf8 locale is
144 09/03/2009. An example of time is 18:00:00. The date format ac‐
145 cepted is influenced by the LC_TIME environmental variable.
146 You may also use the word: now, recent, boot, today, yesterday,
148 this-week, week-ago, this-month, this-year. Now means starting
149 now. Recent is 10 minutes ago. Boot means the time of day to the
150 second when the system last booted. Today means now. Yesterday
151 is 1 second after midnight the previous day. This-week means
152 starting 1 second after midnight on day 0 of the week determined
153 by your locale (see localtime). Week-ago means 1 second after
154 midnight exactly 7 days ago. This-month means 1 second after
155 midnight on day 1 of the month. This-year means the 1 second af‐
156 ter midnight on the first day of the first month.
157 -tm, --terminal
159 Report about terminals
160 -ts, --start [start-date] [start-time]
162 Search for events with time stamps equal to or after the given
163 end time. The format of end time depends on your locale. If the
164 date is omitted, today is assumed. If the time is omitted, mid‐
165 night is assumed. Use 24 hour clock time rather than AM or PM to
166 specify time. An example date using the en_US.utf8 locale is
167 09/03/2009. An example of time is 18:00:00. The date format ac‐
168 cepted is influenced by the LC_TIME environmental variable.
169 You may also use the word: now, recent, boot, today, yesterday,
171 this-week, week-ago, this-month, this-year. Boot means the time
172 of day to the second when the system last booted. Today means
173 starting at 1 second after midnight. Recent is 10 minutes ago.
174 Yesterday is 1 second after midnight the previous day. This-week
175 means starting 1 second after midnight on day 0 of the week de‐
176 termined by your locale (see localtime). Week-ago means starting
177 1 second after midnight exactly 7 days ago. This-month means 1
178 second after midnight on day 1 of the month. This-year means the
179 1 second after midnight on the first day of the first month.
180 -u, --user
182 Report about users
183 -v, --version
185 Print the version and exit
186 --virt Report about Virtualization events
188 -x, --executable
190 Report about executables
191
194 The boot time option is a convenience function and has limitations. The
195 time it calculates is based on time now minus /proc/uptime. If after
196 boot the system clock has been adjusted, perhaps by ntp, then the cal‐
197 culation may be wrong. In that case you'll need to fully specify the
198 time. You can check the time it would use by running:
199 date -d "`cut -f1 -d. /proc/uptime` seconds ago"
201
204 ausearch(8), auditd(8), auditd.conf(5).
205Red Hat March 2017 AUREPORT(8)