Managing Audit System

1. Installing and Enabling auditd

Step	Description	Action
Install auditd	Install the audit daemon package	`sudo apt install auditd` (Debian/Ubuntu) `sudo yum install audit` (RHEL/CentOS)
Start auditd service	Enable and start the audit daemon	`sudo systemctl start auditd` `sudo systemctl enable auditd`
Verify installation	Check that auditd is running	`sudo systemctl status auditd`

Example: Basic auditd configuration

sudo auditctl -w /etc/passwd -p rwxa -k passwd_access

Note: The auditctl command is used to configure audit rules at runtime. Persistent rules should be added to /etc/audit/rules.d/audit.rules.

2. Viewing Audit Rules

Rule	Description	Action	Flags
-a always,exit -F arch=b64 -S execve	Logs all executions of binaries	auditctl -a always,exit -F arch=b64 -S execve	-a: always log, -F: filter, -S: syscall
-w /etc/passwd -p rwxa -k passwd_access	Monitors access to password file	auditctl -w /etc/passwd -p rwxa -k passwd_access	-w: watch file, -p: permissions, -k: key
-a always,exit -F arch=b64 -S openat,open	Logs all file opens	auditctl -a always,exit -F arch=b64 -S openat,open	-S: syscall list, -F: filter

Example: View current audit rules

auditctl -l

Note: The -l flag lists all active audit rules.

3. Adding File Watch Rules

Rule Type	Description	Example	Notes
watch	Monitor file or directory changes	`watch /var/log/syslog`	Triggers on file modifications
watchdir	Monitor all files in a directory recursively	`watchdir /etc`	Useful for configuration file monitoring
watchfile	Monitor a specific file for changes	`watchfile /home/user/config.json`	More granular than watchdir

Example: Adding a File Watch Rule

auditctl -w /etc/passwd -p rwxa -k passwd_access

Note: The -k flag assigns a key to the rule for easier filtering later.

Warning: Adding too many rules can impact system performance.

Flag	Description	Usage Example
-w	Specify the path to watch	`-w /path/to/file`
-p	Set permissions to watch (r=read, w=write, x=execute, a=attribute change)	`-p rwxa`
-k	Assign a key to the rule for logging	`-k custom_key`

4. Adding System Call Rules

System call rules in Linux are managed using the auditctl command, which allows you to define rules for auditing system calls. These rules can be used to monitor specific system calls or system call arguments.

Rule Type	Description	Example
syscalls	Specifies the system calls to audit.	`-a always,exit -F arch=b64 -S openat -F dirfd=-100 -F name=/etc/passwd`
arch	Specifies the architecture for which to audit.	`-F arch=b64`
syscall	Specifies the system call to audit.	`-S openat`
dirfd	Specifies the directory file descriptor.	`-F dirfd=-100`
name	Specifies the file path to audit.	`-F name=/etc/passwd`

Example: Adding a System Call Rule

auditctl -a always,exit -F arch=b64 -S openat -F dirfd=-100 -F name=/etc/passwd

Note: The -a always,exit flag ensures that the rule is applied at all times and logs events upon exit.

Warning: Adding too many audit rules can impact system performance. Always test in a non-production environment.

5. Searching Audit Logs

Command	Description	Example
ausearch	Searches audit logs for specific events or patterns	`ausearch -ts recent -k login`
aureport	Generates reports from audit logs	`aureport --start recent --end now`
ausearch -k	Searches logs by key (e.g., login events)	`ausearch -k login`
ausearch --start / --end	Filters logs by timestamp range	`ausearch --start '2024-01-01 00:00' --end '2024-01-01 23:59'`

ausearch -ts recent -k login

ausearch -ts recent -m login -f

Note: The ausearch command requires the auditd service to be running.

Warning: Audit logs can contain sensitive data. Ensure appropriate access controls are in place.

6. Generating Audit Reports

Report Type	Description	Command	Notes
System Logs	Reports on system-level activities and events	`ausearch -ts recent`	Use `-ts` to filter by timestamp
User Activity	Tracks user login/logout and command execution	`aureport --user`	Shows detailed user session logs
File Access	Logs file access and modification events	`aureport --file`	Includes file permissions and ownership changes
Network Activity	Records network-related system events	`aureport --network`	Can show connection attempts and data transfers
Summary Report	Aggregated view of audit events over a period	`aureport --summary`	Useful for compliance and system health checks

Example: Generate a user activity report

ausearch --user --start recent --end recent

Example: Export audit report to a file

aureport --user --output /var/log/audit_report.txt

Note: Ensure the auditd service is running before generating reports. Use systemctl status auditd to verify.

Warning: Audit logs can grow very large. Regularly rotate or archive logs to prevent disk space issues.

7. Configuring Audit Rules

Rule Component	Description	Example
-a	Specifies the audit action to take when a rule is matched	`-a always,exit -F arch=b64 -S execve`
-F	Specifies a filter field to match against	`-F uid=1000`
-S	Specifies a system call to audit	`-S openat -S open`
-F arch=b64	Matches 64-bit architecture (b64) or b32 for 32-bit	`-F arch=b64`
-F uid=1000	Matches a specific user ID	`-F uid=1000`
-F pid=1234	Matches a specific process ID	`-F pid=1234`
-F msg=audit	Matches a specific audit message	`-F msg=audit`

Example: Basic Audit Rule Configuration

# Add a rule to audit all execve system calls
auditctl -a always,exit -F arch=b64 -S execve

# Add a rule to audit file access by UID
auditctl -a always,exit -F uid=1000 -F arch=b64 -S openat

# List current audit rules
auditctl -l

Note: Audit rules are applied in order, and the last matching rule takes effect. Rules can be added or removed dynamically using auditctl.

Warning: Misconfigured audit rules can lead to performance degradation or excessive logging. Always test in a non-production environment.

8. Managing Audit Log Rotation

Configuration Option	Description	Default Value	Notes
max_log_file	Maximum size of audit log file before rotation	`10M`	Can be specified in bytes (B), kilobytes (K), megabytes (M), or gigabytes (G)
max_log_file_action	Action to take when max_log_file is reached	`keep_logs`	Options: `keep_logs`, `rotate`, `delete`
num_logs	Number of rotated log files to keep	`5`	Only applicable when `max_log_file_action` is set to `rotate`

Example: Configuring Audit Log Rotation

# Edit the audit configuration file
sudo vim /etc/audit/auditd.conf

# Set max_log_file to 50MB
max_log_file = 50M

# Set max_log_file_action to rotate
max_log_file_action = rotate

# Keep 10 rotated logs
num_logs = 10

Note: Changes to /etc/audit/auditd.conf require a restart of the audit daemon to take effect.

Steps to Rotate Audit Logs Manually

Stop the audit daemon: sudo systemctl stop auditd
Rotate logs using the auditctl command: sudo auditctl -R /etc/audit/rules.d/audit.rules
Restart the audit daemon: sudo systemctl start auditd

9. Filtering Audit Events

Filter Type	Description	Usage Example
-a	Specify audit rules to be added or deleted	`auditctl -a always,exit -F arch=b64 -S openat`
-F	Filter by field value (e.g., syscall, UID, GID)	`auditctl -a always,exit -F uid=1000`
-S	Filter by syscall number or name	`auditctl -a always,exit -S openat,open`
-F arch=b64	Filter by architecture (64-bit)	`auditctl -a always,exit -F arch=b64 -S execve`
-F dir	Filter by directory path	`auditctl -a always,exit -F dir=/tmp`

Example: Filtering by syscall and UID

auditctl -a always,exit -S openat -F uid=1000

Example: Filtering by architecture and syscall

auditctl -a always,exit -F arch=b64 -S execve

Note: The -a option specifies the audit rule's action (e.g., always, never) and whether it should be logged on exit or entry.

Warning: Incorrect use of filter options can lead to missed audit events or excessive logging. Always test rules in a non-production environment.

10. Understanding Audit Log Format

Field	Description	Example Value
type	Event type identifier	`audit`
msg	Message content	`audit log format`
pid	Process ID	`1234`
uid	User ID	`1000`
gid	Group ID	`1000`
auid	Account User ID	`1000`
ses	Session ID	`123456789`
comm	Command name	`ls`
exe	Executable path	`/bin/ls`
syscall	System call number	`2`
arch	Architecture	`b64`
success	Success status	`yes`

Example: Audit Log Entry


audit: type=1000 msg=audit(1623456789.123:456): pid=1234 uid=1000 gid=1000 auid=1000 ses=123456789 comm="ls" exe="/bin/ls" arch=b64 syscall=2 success=yes

Note: The audit log format is designed to be machine-readable and includes detailed metadata about system events.