Differences

This shows you the differences between two versions of the page.

--- auditing:view_audit_reports [2016/07/28 10:05] – [Auditing - View audit reports] peter
+++ auditing:view_audit_reports [2019/11/26 20:16] (current) – removed peter
@@ Line 1: / Line 1: @@
-====== Auditing - View audit reports ======
-**aureport** is a tool that produces summary reports of the audit system log.
-Without any parameters, **aureport** will generate a summary report of audit activity.
-<code bash>
-sudo aureport
-</code>
-Result:
-<code>
-Summary Report
-======================
-Range of time in logs: 16/07/16 01:32:46.053 - 16/07/16 10:34:01.482
-Selected time for report: 16/07/16 01:32:46 - 16/07/16 10:34:01.482
-Number of changes in configuration: 2
-Number of changes to accounts, groups, or roles: 0
-Number of logins: 0
-Number of failed logins: 0
-Number of authentications: 2
-Number of failed authentications: 1
-Number of users: 4
-Number of terminals: 14
-Number of host names: 6
-Number of executables: 107
-Number of commands: 155
-Number of files: 186
-Number of AVC's: 0
-Number of MAC events: 0
-Number of failed syscalls: 33
-Number of anomaly events: 0
-Number of responses to anomaly events: 0
-Number of crypto events: 0
-Number of integrity events: 0
-Number of virt events: 0
-Number of keys: 8
-Number of process IDs: 29325
-Number of events: 31471
-</code>
-This shows some important information.
-For example, it shows that there was a failed authentication.  Using aureport, we can drill down to that information.
-We can use this command to look deeper on failed authentication:
-<code bash>
-sudo aureport -au
-</code>
-Result:
-<code>
-Authentication Report
-============================================
-# date time acct host term exe success event
-============================================
-. 16/07/16 07:21:50 anonymous ::ffff:198.20.70.114 ftp /usr/sbin/vsftpd no 3104248
-. 16/07/16 09:07:47 peter ? /dev/pts/0 /usr/bin/sudo yes 3106600
-. 16/07/16 10:33:53 peter ? /dev/pts/0 /usr/bin/sudo yes 3107479
-</code>
-Row 1 has a "**no**" near the end of the line, which indicates that authentication failed.
-===== Check all events related to account modification =====
-Use the **-m** parameter.
-<code bash>
-sudo areport -m
-</code>
-Result:
-<code bash>
-=================================================
-# date time auid addr term exe acct success event
-=================================================
-<no events of interest were found>
-</code>