On Tue, 2007-09-25 at 09:21 -0400, Scott Ehrlich wrote: Your best bet might be to use the auparse library, or ausearch which knows how to interpret the audit log format for you and can present the information in a human friendly format. type=SYSCALL msg=audit(1166045975.667:1128): foo=bar ... But if you want to roll your own here's a quick intro using the above as an example. Most of the data are key=value pairs. The first key is the audit record type. In the example the audit record type is SYSCALL. Then comes an event ID. A single event that has been audited may consist of multiple independent records which are NOT necessarily sequentially emitted by the audit system. The independent records must be assembled into a set of records comprising the event. The audit(sss.mmm:xxx) is the event ID. The first integer is a UNIX time stamp (seconds after the epoch), the second integer is a millisecond offset, the third integer after the colon is a sequence number to provide uniqueness to the second.milli time stamp. Everything after that is formatted according to the record type, but is typically a sequence of key/value pairs. -- John Dennis <jdennis(a)redhat.com&gt;

On Tuesday 25 September 2007 10:50:13 Wieprecht, Karen M. wrote: It doesn't actually present the information in a human friendly format. Auparse is a library that can be used to write programs to present data in a human friendly output. But someone has to write the code. Basically, it saves you from having to know the details of what the audit log's file format is and present the programmer with a smart iterator that can walk the input source. Yes. It would let you write an app that is more efficient than using perl on ausearch output. For example, I decided to write a lastlog replacement that works off the audit logs. The main code loop looks something like this: auparse_state_t *au; // Search for successful user logins au = auparse_init(AUSOURCE_LOGS, NULL); if (au == NULL) { printf("Error - %s\n", strerror(errno)); goto error_exit_1; } if (ausearch_add_item(au, "type", "=", "USER_LOGIN", AUSEARCH_RULE_CLEAR)){ printf("ausearch_add_item error - %s\n", strerror(errno)); goto error_exit_2; } if (ausearch_add_item(au, "res", "=", "success", AUSEARCH_RULE_AND)){ printf("ausearch_add_item error - %s\n", strerror(errno)); goto error_exit_2; } if (ausearch_set_stop(au, AUSEARCH_STOP_RECORD)){ printf("ausearch_set_stop error - %s\n", strerror(errno)); goto error_exit_2; } // Now scan the logs and append events while (ausearch_next_event(au) > 0) { const au_event_t *e = auparse_get_timestamp(au); if (auparse_find_field(au, "auid")) { uid_t u = auparse_get_field_int(au); list_first(&l); if (list_find_uid(&l, u)) { const char *str; list_update_login(&l, e->sec); str = auparse_find_field(au, "hostname"); if (str) list_update_host(&l, str); str = auparse_find_field(au, "terminal"); if (str) list_update_term(&l, str); } } auparse_next_event(au); } auparse_destroy(au); At this point the program walks it linked list and outputs the data in lastlog format. I was planning to write this program up in a tutorial at some point so that people can see how easy auparse makes writing apps for audit logs. -Steve

On Tuesday 25 September 2007 12:43:52 James Antill wrote: Sure it is. perl cannot do the interpretations. So you'd have to spend time writing all that code and maintain it or use ausearch to provide you that functionality. It does a lot more than "cat". For example, it understands the ordering requirements of the logs and searches them in the correct order. It also assembles the records into an event before presenting them. It interprets some of the data so that its more usable even if you don't ask for a full interpretation. -Steve