audit normalizer

Hello, The audit user space package has gained some real interesting features during the 2.7.x releases. The events can now be normalized. So, what exactly does that mean? Events are composed of subject, action, object, and results. With the format of the audit events, it can be hard for the unintiated to really tell what's where with all the name=value fields and multi-lined events. What the normalizer does is takes all that guess work out of interpreting the event. Its presents an API in auparse that you can use to say, give me the subject, give me the action, give me the results, etc. The upshot of this is that you can use this to turn events into English sentences. For example, this: time->Mon Feb 13 10:09:04 2017 type=PROCTITLE msg=audit(1486998544.895:837): proctitle=2F7573722F62696E2F696E7374616C6C002D6300636F6E66746573742E6F6E6500636F6E66746573742E74776F002F686F6D652F7367727562622F776F726B696E672F4255494C442F61756469742F636F6E66746573742E646972 type=PATH msg=audit(1486998544.895:837): item=0 name="/etc/selinux/config" inode=17041117 dev=08:32 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:selinux_config_t:s0 nametype=NORMAL type=CWD msg=audit(1486998544.895:837): cwd="/home/sgrubb/working/BUILD/audit" type=SYSCALL msg=audit(1486998544.895:837): arch=c000003e syscall=2 success=no exit=-13 a0=7fb05b8d5b8b a1=0 a2=1b6 a3=0 items=1 ppid=30491 pid=30650 auid=4325 uid=4325 gid=4325 euid=4325 suid=4325 fsuid=4325 egid=4325 sgid=4325 fsgid=4325 tty=pts3 ses=4 comm="install" exe="/usr/bin/install" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="access" Becomes: At 10:09:04 02/13/2017 sgrubb unsuccessfully opened-file /etc/selinux/config using /usr/bin/install Big difference? Try it yourself. ausearch --start today --format text But wait...there's more!!! ausearch can now also output events as a comma separated file (CSV) format. What this can do for you is open the whole world to high quality visualizations of audit events. You can do this: ausearch --start today --format csv > audit.csv Then you can open the file with libreoffice if you like: ooffice audit.csv Review the sample import and adjust or Click on OK when it asks. Then you should see the audit data in nice neat columns with one event per row. If you like using spreadsheets to do charts and graphs, have at it. Or, you can close the spreadsheet and visit here: http://app.rawgraphs.io/ Open your csv file in gedit or something and select all rows and copy to the clipboard. The paste your data into the box at app.rawgraphs.io. Then select alluvial diagram. Then scroll down to "map your dimensions". Grab "subj_prime" and drag it to the box labeled "steps". Then grab "event_kind" and drag it under "subj_prime". Then grab "action" and drag it under "event_kind". This shows who is doing what kind of things on the system. If you wanted to see what login accounts transition to other accounts, delete the green boxes in the "steps" section and grab "subj_prime" and drag it to the "steps". Then grab "subj_sec" and drag it under "subj_prime". There's your chart. Its that easy. There are a few things that say "unknown". This is caused by malformed events that we are still working to correct. Feel free to experiment. You can't really break anything. As mentioned before, I will be starting up a blog to explain how to use the R programming langauge to create interesting reports. With the logs normalized, we can now use Data Science tools to look at logs. That opens a whole lot of doors. -Steve