1AUREPORT(8)             System Administration Utilities            AUREPORT(8)
2
3
4

NAME

6       aureport - a tool that produces summary reports of audit daemon logs
7

SYNOPSIS

9       aureport [options]
10

DESCRIPTION

12       aureport  is  a  tool that produces summary reports of the audit system
13       logs. The aureport utility can also take input from stdin  as  long  as
14       the  input  is the raw log data. The reports have a column label at the
15       top to help with interpretation of the various fields. Except  for  the
16       main  summary  report, all reports have the audit event number. You can
17       subsequently lookup the full event with ausearch -a event  number.  You
18       may  need  to  specify start & stop times if you get multiple hits. The
19       reports produced by aureport can be used as building  blocks  for  more
20       complicated analysis.
21
22

OPTIONS

24       -au, --auth
25              Report about authentication attempts
26
27       -a, --avc
28              Report about avc messages
29
30       --comm Report about commands run
31
32       -c, --config
33              Report about config changes
34
35       -cr, --crypto
36              Report about crypto events
37
38       --debug
39              Write malformed events that are skipped to stderr.
40
41       --eoe-timeout seconds
42              Set  the  end of event parsing timeout. See end_of_event_timeout
43              in auditd.conf(5) for details. Note that setting this value will
44              override any configured value found in /etc/auditd/auditd.conf.
45
46       -e, --event
47              Report about events
48
49       --escape option
50              This option determines if the output is escaped to make the con‐
51              tent safer for certain uses. The options are raw , tty , shell ,
52              and  shell_quote.  Each mode includes the characters of the pre‐
53              ceding mode and escapes more characters. That is  to  say  shell
54              includes all characters escaped by tty and adds more. tty is the
55              default.
56
57       -f, --file
58              Report about files and af_unix sockets
59
60       --failed
61              Only select failed events for processing in the reports. The de‐
62              fault is both success and failed events.
63
64       -h, --host
65              Report about hosts
66
67       --help Print brief command summary
68
69       -i, --interpret
70              Interpret  numeric  entities into text. For example, uid is con‐
71              verted to account name. The conversion is done using the current
72              resources  of  the machine where the search is being run. If you
73              have renamed the accounts, or don't have the  same  accounts  on
74              your machine, you could get misleading results.
75
76       -if, --input file | directory
77              Use  the given file or directory instead of the logs. This is to
78              aid analysis where the logs have been moved to  another  machine
79              or  only  part of a log was saved. The path length is limited to
80              4064 bytes.
81
82       --input-logs
83              Use the log file location from auditd.conf as input  for  analy‐
84              sis. This is needed if you are using aureport from a cron job.
85
86       --integrity
87              Report about integrity events
88
89       -k, --key
90              Report about audit rule keys
91
92       -l, --login
93              Report about logins
94
95       -m, --mods
96              Report about account modifications
97
98       -ma, --mac
99              Report about Mandatory Access Control (MAC) events
100
101       -n, --anomaly
102              Report about anomaly events. These events include NIC going into
103              promiscuous mode and programs segfaulting.
104
105       --node node-name
106              Only select events originating from node name  string  for  pro‐
107              cessing  in  the  reports.  The default is to include all nodes.
108              Multiple nodes are allowed.
109
110       -nc, --no-config
111              Do not include the CONFIG_CHANGE  event.  This  is  particularly
112              useful for the key report because audit rules have key labels in
113              many cases. Using this option gets rid of these false positives.
114
115       -p, --pid
116              Report about processes
117
118       -r, --response
119              Report about responses to anomaly events
120
121       -s, --syscall
122              Report about syscalls
123
124       --success
125              Only select successful events for processing in the reports. The
126              default is both success and failed events.
127
128       --summary
129              Run the summary report that gives a total of the elements of the
130              main report. Not all reports have a summary.
131
132       -t, --log
133              This option will output a report of the start and end times  for
134              each log.
135
136       --tty  Report about tty keystrokes
137
138       -te, --end [end-date] [end-time]
139              Search  for events with time stamps equal to or before the given
140              end time. The format of end time depends on your locale. If  the
141              date  is  omitted, today is assumed. If the time is omitted, now
142              is assumed. Use 24 hour clock time rather than AM or PM to spec‐
143              ify  time.  An  example  date  using  the  en_US.utf8  locale is
144              09/03/2009. An example of time is 18:00:00. The date format  ac‐
145              cepted is influenced by the LC_TIME environmental variable.
146
147              You  may also use the word: now, recent, this-hour, boot, today,
148              yesterday, this-week, week-ago, this-month, this-year. Now means
149              starting  now.  Recent is 10 minutes ago. Boot means the time of
150              day to the second when the system last booted. Today means  now.
151              Yesterday is 1 second after midnight the previous day. This-week
152              means starting 1 second after midnight on day 0 of the week  de‐
153              termined by your locale (see localtime). Week-ago means 1 second
154              after midnight exactly 7 days ago. This-month means 1 second af‐
155              ter midnight on day 1 of the month. This-year means the 1 second
156              after midnight on the first day of the first month.
157
158       -tm, --terminal
159              Report about terminals
160
161       -ts, --start [start-date] [start-time]
162              Search for events with time stamps equal to or after  the  given
163              end  time. The format of end time depends on your locale. If the
164              date is omitted, today is assumed. If the time is omitted,  mid‐
165              night is assumed. Use 24 hour clock time rather than AM or PM to
166              specify time. An example date using  the  en_US.utf8  locale  is
167              09/03/2009.  An example of time is 18:00:00. The date format ac‐
168              cepted is influenced by the LC_TIME environmental variable.
169
170              You may also use the word: now, recent, this-hour, boot,  today,
171              yesterday,  this-week,  week-ago,  this-month,  this-year.  Boot
172              means the time of day to the second when the system last booted.
173              Today  means  starting  at 1 second after midnight. Recent is 10
174              minutes ago. Yesterday is 1 second after midnight  the  previous
175              day.  This-week  means starting 1 second after midnight on day 0
176              of the week determined by your locale (see localtime).  Week-ago
177              means  starting  1  second  after  midnight  exactly 7 days ago.
178              This-month means 1 second after midnight on day 1 of the  month.
179              This-year  means the 1 second after midnight on the first day of
180              the first month.
181
182       -u, --user
183              Report about users
184
185       -v, --version
186              Print the version and exit
187
188       --virt Report about Virtualization events
189
190       -x, --executable
191              Report about executables
192
193

NOTE

195       The boot time option is a convenience function and has limitations. The
196       time  it  calculates  is based on time now minus /proc/uptime. If after
197       boot the system clock has been adjusted, perhaps by ntp, then the  cal‐
198       culation  may  be  wrong. In that case you'll need to fully specify the
199       time. You can check the time it would use by running:
200
201       date -d "`cut -f1 -d. /proc/uptime` seconds ago"
202
203

SEE ALSO

205       ausearch(8), auditd(8), auditd.conf(5).
206
207
208
209Red Hat                          February 2023                     AUREPORT(8)
Impressum