查看日志中的auditd日志

Question

我正在使用CentOS 7.试图在journalctl中查看auditd日志

当我尝试journalctl -u auditd时，我看到以下输出：

-- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 EDT. --
Sep 05 12:59:25 centos7 systemd[1]: Starting Security Auditing Service...
Sep 05 12:59:25 centos7 auditd[563]: Started dispatcher: /sbin/audispd pid: 565
Sep 05 12:59:25 centos7 audispd[565]: No plugins found, exiting
Sep 05 12:59:25 centos7 auditd[563]: Init complete, auditd 2.8.1 listening for events (startup state enable)
Sep 05 12:59:25 centos7 augenrules[567]: /sbin/augenrules: No change
Sep 05 12:59:25 centos7 augenrules[567]: No rules
Sep 05 12:59:25 centos7 augenrules[567]: enabled 1
Sep 05 12:59:25 centos7 augenrules[567]: failure 1
Sep 05 12:59:25 centos7 augenrules[567]: pid 563
Sep 05 12:59:25 centos7 augenrules[567]: rate_limit 0
Sep 05 12:59:25 centos7 augenrules[567]: backlog_limit 8192
Sep 05 12:59:25 centos7 augenrules[567]: lost 0
Sep 05 12:59:25 centos7 augenrules[567]: backlog 1
Sep 05 12:59:25 centos7 augenrules[567]: enabled 1
Sep 05 12:59:25 centos7 augenrules[567]: failure 1
Sep 05 12:59:25 centos7 augenrules[567]: pid 563
Sep 05 12:59:25 centos7 augenrules[567]: rate_limit 0
Sep 05 12:59:25 centos7 augenrules[567]: backlog_limit 8192
Sep 05 12:59:25 centos7 augenrules[567]: lost 0
Sep 05 12:59:25 centos7 augenrules[567]: backlog 1
Sep 05 12:59:25 centos7 systemd[1]: Started Security Auditing Service.

这就是它的终点。

如果运行tail -3 /var/log/audit/audit.log，就会看到预期的输出：

type=CRED_REFR msg=audit(1537383661.096:4863)：pid=13894 uid=0 auid=0 ses=567 msg='op=PAM:setcred grantors=pam_env，pam_faillock，pam_unix acct="root“exe=/usr/sbin/crond”hostname=？addr=？terminal=cron res=success‘type=CRED_DISP msg=audit(1537383661.107:4864)：pid=13894 uid=0 auid=0 ses=567 msg='op=PAM:setcred grantors=pam_env，pam_faillock，pam_unix acct="root“exe=/usr/sbin/crond”hostname=？addr=？terminal=cron res=success‘type=USER_END msg=audit(1537383661.109:4865)：pid=13894 uid=0 auid=0 ses=567 msg='op=PAM:session_close grantors=pam_loginuid，pam_keyinit，pam_limits，pam_systemd acct="root“exe=/usr/sbin/crond？addr=？terminal=cron res=success‘

我看了https://major.io/2017/01/05/display-auditd-messages-with-journalctl/的说明

从该页面运行此命令将给出输出，然后等待(如预期的那样)。

$ journalctl -af _TRANSPORT=audit
-- Logs begin at Wed 2018-09-05 08:59:19 EDT. --

如何配置journalctl或auditd以查看D10文件在journalctl中看到的输出？

Answer 1

我在那里也没有找到任何火柴。然后我做了这个journalctl _TRANSPORT=syslog，发现我确实有匹配的。这使我进行了一些调查，我发现，如果我筛选了一些特定的东西，例如sshd，那么我就找到了匹配，尽管它们看起来完全不同。下面是一个实际的例子：

audit.log : type=CRED_REFR msg=audit(1537414472.742:270819): pid=20227 uid=0 auid=0 ses=30399 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/sbin/sshd" hostname=130.19.106.234 addr=130.19.106.234 terminal=ssh res=success'
journalctl _TRANSPORT=syslog | grep sshd | tail

输出

Sep 19 20:34:32 ndc1ascem2rad1.eng.mobilephone.net sshd[20225]: Accepted publickey for root from 130.19.106.234 port 60853 ssh2: RSA 00:7e:b4:44:05:c0:fa:e3:xxxxxxxxxxxxxxxxxxxxxx
Sep 19 20:34:32 ndc1ascem2rad1.eng.mobilephone.net sshd[20225]: pam_unix(sshd:session): session opened for user root by (uid=0)

注意IP地址匹配。所以试试_TRANSPORT=syslog吧。