Overview
aureport reads audit log files recorded by auditd (defaulting to /var/log/audit/audit.log) and generates summarized reports based on specified criteria. This allows for a quick understanding of the system's security status and identification of potential threats.
Key Features
- Generates log summaries and statistics
- Provides various types of event reports (logins, file access, executed programs, etc.)
- Supports security auditing and compliance
Key Options
aureport offers a variety of report types and filtering options.
Report Types
Filtering and Output
Generated command:
Try combining the commands.
Description:
`aureport` Executes the command.
Combine the above options to virtually execute commands with AI.
Usage Examples
Examples of generating various reports using the aureport command.
Report of All Login/Logout Attempts
aureport -lChecks all login and logout events on the system.
Authentication Attempts from Yesterday to Today
aureport -au --start yesterdayGenerates a report on authentication attempts that occurred from midnight yesterday to the present.
File Access Report for This Week
aureport -f --start this-weekSummarizes file access events that occurred this week.
Report of All Programs Executed Today
aureport -x --start today --end nowGenerates a report on all programs executed today.
Summary Report of Failed Events
aureport -i --failedSummarizes only the failed events among all audit events.
Installation
aureport is part of the audit package. If it is not installed by default on your Linux distribution, you can install it using the following commands.
Debian/Ubuntu
sudo apt update && sudo apt install auditdInstall the auditd package using the apt package manager.
CentOS/RHEL
sudo yum install auditInstall the audit package using the yum package manager.
Fedora
sudo dnf install auditInstall the audit package using the dnf package manager.
Tips & Notes
Tips and notes for effectively using aureport.
Useful Tips
- **Time Specification**: You can use relative time expressions like 'today', 'yesterday', 'this-week', 'this-month', 'now' for the `--start` and `--end` options.
- **Log File Location**: By default, it uses `/var/log/audit/audit.log`, but this can be changed in the `auditd.conf` configuration.
- **Performance**: Processing large amounts of log data can be time-consuming. It is recommended to clearly specify the required period and report type.
- **Using with `ausearch`**: You can first filter logs that meet specific criteria using `ausearch`, and then pipe the results to `aureport` to generate more refined reports. Example: `ausearch -m USER_LOGIN -sv no | aureport -l`