How to use Aureport command on Linux
To use aureport command on Linux
Aureport is a tool that produces summary reports of the audit system logs. The aureport utility can also take input from stdin as long as the input is the raw log data. The reports have a column label at the top to help with interpretation of the various fields. Except for the main summary report, all reports have the audit event number. You can subsequently lookup the full event with ausearch -a event number. You may need to specify start & stop times if you get multiple hits. The reports produced by aureport can be used as building blocks for more complicated analysis. aureport is not a complex command, it is very simple to use, and by the end of this tutorial, you will get to know the ways through which aureport command can be used to generate various reports.
Using aureport
If you want to the summary report of the aureport, you shall simply run the following command. The summary report is generated as the output.
[root@linuxhelp ~]# aureport
Summary Report
======================
Range of time in logs: 08/04/2017 17:17:36.535 - 11/24/2017 17:50:01.537
Selected time for report: 08/04/2017 17:17:36 - 11/24/2017 17:50:01.537
Number of changes in configuration: 6
Number of changes to accounts, groups, or roles: 1
Number of logins: 2
Number of failed logins: 1
Number of authentications: 3
Number of failed authentications: 1
Number of users: 2
Number of terminals: 7
Number of host names: 1
Number of executables: 8
Number of commands: 1
Number of files: 0
Number of AVC' s: 0
Number of MAC events: 4
Number of failed syscalls: 0
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 4
Number of integrity events: 0
Number of virt events: 0
Number of keys: 0
Number of process IDs: 43
Number of events: 201
In case of generating the authentication report, you are required to run the aureport command with the au option.
[root@linuxhelp ~]# aureport -au
Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 08/04/2017 12:53:20 ? ? :0 /usr/libexec/gdm-session-worker no 55
2. 08/04/2017 12:53:31 root ? :0 /usr/libexec/gdm-session-worker yes 57
3. 08/04/2017 13:02:15 root ? pts/1 /usr/sbin/userhelper yes 77
4. 08/04/2017 14:25:15 root ? :0 /usr/libexec/gdm-session-worker yes 5
The aureport command can also be used to view the executables report. You shall get that report from the following command.
[root@linuxhelp ~]# aureport -x
Executable Report
====================================
# date time exe term host auid event
====================================
1. 08/04/2017 17:20:01 /usr/sbin/crond cron ? -1 6
2. 08/04/2017 17:20:01 /usr/sbin/crond cron ? -1 7
3. 08/04/2017 17:20:01 /usr/sbin/crond cron ? 0 9
4. 08/04/2017 17:20:02 /usr/sbin/crond cron ? 0 10
5. 08/04/2017 17:20:02 /usr/sbin/crond cron ? 0 11
6. 08/04/2017 17:30:01 /usr/sbin/crond cron ? -1 12
7. 08/04/2017 17:30:01 /usr/sbin/crond cron ? -1 13
8. 08/04/2017 17:30:01 /usr/sbin/crond cron ? 0 15
9. 08/04/2017 17:30:01 /usr/sbin/crond cron ? 0 16
.
.
.
.
137166. 11/24/2017 18:04:39 /usr/sbin/sshd ssh 192.168.7.219 -1 5538
137167. 11/24/2017 18:04:39 /usr/sbin/sshd ssh 192.168.7.219 -1 5539
137168. 11/24/2017 18:04:39 /usr/sbin/sshd ? 192.168.7.219 -1 5540
137169. 11/24/2017 18:04:39 /usr/sbin/sshd ssh 192.168.7.219 -1 5541
137170. 11/24/2017 18:04:39 /usr/sbin/sshd ssh 192.168.7.219 -1 5542
137171. 11/24/2017 18:04:39 /usr/sbin/sshd ssh 192.168.7.219 0 5544
137172. 11/24/2017 18:04:39 /usr/sbin/sshd /dev/pts/0 192.168.7.219 0 5545
137173. 11/24/2017 18:04:39 /usr/sbin/sshd /dev/pts/0 192.168.7.219 0 5546
137174. 11/24/2017 18:04:39 /usr/sbin/sshd pts/0 192.168.7.219 0 5547
137175. 11/24/2017 18:04:39 /usr/sbin/sshd pts/0 192.168.7.219 0 5548
137176. 11/24/2017 18:04:39 /usr/sbin/sshd ssh 192.168.7.219 0 5549
If you want to view the login report, you shall run the following command.
[root@linuxhelp ~]# aureport -l
Login Report
============================================
# date time auid host term exe success event
============================================
1. 08/04/2017 12:53:20 roo ? /dev/tty1 /usr/libexec/gdm-session-worker no 56
2. 08/04/2017 12:53:31 -1 ? /dev/tty1 /usr/libexec/gdm-session-worker yes 63
3. 08/04/2017 14:25:15 -1 ? /dev/tty1 /usr/libexec/gdm-session-worker yes 10
Viewing the crpto report is also possible with the help of the following command.
[root@linuxhelp ~]# aureport -cr
Crypto Report
===================================
# date time auid type success event
===================================
1. 08/04/2017 14:15:57 -1 CRYPTO_KEY_USER yes 122
2. 08/04/2017 14:15:57 -1 CRYPTO_KEY_USER yes 123
3. 08/04/2017 14:23:55 0 CRYPTO_KEY_USER yes 134
4. 08/04/2017 14:23:55 0 CRYPTO_KEY_USER yes 135
You shall also check our the account modification report by running the following command.
[root@linuxhelp ~]# aureport -m
Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 08/04/2017 14:17:20 0 ? ? /usr/sbin/groupadd wbpriv no 124
2. 11/23/2017 15:09:16 0 ? ? /usr/sbin/groupadd ? yes 71
3. 11/23/2017 15:09:16 0 ? ? /usr/sbin/groupadd ? yes 72
4. 11/23/2017 15:09:17 0 ? ? /usr/sbin/useradd ? yes 73
5.
In order to view the PID report, you shall run the following command.
[root@linuxhelp ~]# aureport -p
Process ID Report
======================================
# date time pid exe syscall auid event
======================================
1. 08/04/2017 17:17:36 1339 ? 0 -1 1297
2. 08/04/2017 17:20:01 1990 /usr/sbin/crond 0 -1 6
3. 08/04/2017 17:20:01 1990 /usr/sbin/crond 0 -1 7
4. 08/04/2017 17:20:01 1990 ? 0 0 8
5. 08/04/2017 17:20:01 1990 /usr/sbin/crond 0 0 9
6. 08/04/2017 17:20:02 1990 /usr/sbin/crond 0 0 10
.
.
.
.
204. 11/23/2017 15:10:01 4338 /usr/sbin/crond 0 -1 75
205. 11/23/2017 15:10:01 4338 ? 0 0 76
206. 11/23/2017 15:10:01 4338 /usr/sbin/crond 0 0 77
207. 11/23/2017 15:10:01 4338 /usr/sbin/crond 0 0 78
208. 11/23/2017 15:10:01 4338 /usr/sbin/crond 0 0 79
209. 11/24/2017 18:10:01 4678 /usr/sbin/crond 0 -1 80
210. 11/24/2017 18:10:01 4678 /usr/sbin/crond 0 -1 81
211. 11/24/2017 18:10:01 4678 ? 0 0 82
212. 11/24/2017 18:10:01 4678 /usr/sbin/crond 0 0 83
213. 11/24/2017 18:10:01 4678 /usr/sbin/crond 0 0 84
214. 11/24/2017 18:10:01 4678 /usr/sbin/crond 0 0 85
Also, you shall view the Syscall Report, if you run the following command.
[root@linuxhelp ~]# aureport -s
Syscall Report
=======================================
# date time syscall pid comm auid event
=======================================
1. 08/04/2017 13:00:52 1 3510 load_policy 0 70
2. 08/04/2017 13:52:52 1 52301 load_policy 0 103
3. 08/04/2017 14:17:53 1 64635 load_policy 0 125
In order to view the success report, you can simply run the success option with the aureport command in the following manner.
[root@linuxhelp ~]# aureport --success
Success Summary Report
======================
Range of time in logs: 08/04/2017 17:17:36.535 - 11/24/2017 18:10:01.714
Selected time for report: 08/04/2017 17:17:36 - 11/24/2017 18:10:01.714
Number of changes in configuration: 6
Number of changes to accounts, groups, or roles: 3
Number of logins: 2
Number of failed logins: 0
Number of authentications: 3
Number of failed authentications: 0
Number of users: 2
Number of terminals: 7
Number of host names: 1
Number of executables: 9
Number of commands: 1
Number of files: 0
Number of AVC' s: 0
Number of MAC events: 4
Number of failed syscalls: 0
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 4
Number of integrity events: 0
Number of virt events: 0
Number of keys: 0
Number of process IDs: 45
Number of events: 213
Finally, if you want to view the additional options, you can simply run the help option along with the aureport command.
[root@linuxhelp ~]# aureport --help
usage: aureport [options]
-a,--avc Avc report
-au,--auth Authentication report
--comm Commands run report
-c,--config Config change report
-cr,--crypto Crypto report
-e,--event Event report
-f,--file File name report
--failed only failed events in report
-h,--host Remote Host name report
--help help
-i,--interpret Interpretive mode
-if,--input < Input File name> use this file as input
--input-logs Use the logs even if stdin is a pipe
--integrity Integrity event report
-l,--login Login report
-k,--key Key report
-m,--mods Modification to accounts report
-ma,--mac Mandatory Access Control (MAC) report
-n,--anomaly aNomaly report
-nc,--no-config Don' t include config events
--node < node name> Only events from a specific node
-p,--pid Pid report
-r,--response Response to anomaly report
-s,--syscall Syscall report
--success only success events in report
--summary sorted totals for main object in report
-t,--log Log time range report
-te,--end [end date] [end time] ending date & time for reports
-tm,--terminal TerMinal name report
-ts,--start [start date] [start time] starting data & time for reports
--tty Report about tty keystrokes
-u,--user User name report
-v,--version Version
--virt Virtualization report
-x,--executable eXecutable name report
If no report is given, the summary report will be displayed
With this, the coverage of the usage of aureport command comes to an end.
Q
Why to use the Aureport command in Linux?
A
Aureport is a tool that produces summary reports of the audit system logs. The aureport utility can also take input from stdin as long as the input is the raw log data.
Q
Is there any alternative way other than "lslogins"?
A
who command aureport are some of useful commands
Q
How to execute commands execyed in history directly?
A
Exclamatory mark followed by the command number in history status
Q
Does the shutdown command at particular time is base on 12hr or 24 hr format?
A
It is based on the Timezone assigned in it
Q
How can I install mc in fedora ?
A
use the following command "dnf install mc" simple!!