audit_tool(8) System Manager's Manual audit_tool(8)
Name
audit_tool - ULTRIX auditlog reduction tool
Syntax
/usr/etc/sec/audit_tool [ option ... ] auditlog_filename
Description
The presents a human-understandable format of selected portions of the collected audit data. If no arguments are provided, a brief help
message will be displayed. The auditlog file may be compressed or uncompressed. The command will uncompress the auditlog file if neces-
sary, and re-compress it if it was originally compressed.
Options are used to select specific audit records of interest. For a record to be selected, it must match at least one option of each
option type specified. For example, if two usernames and one hostname were specified, an audit record to be selected would have to match
one of the usernames and the hostname. Only one start/end time may be selected. Only one deselection rulesfile may be selected. It is
possible to select as many events as exists on the system. For all other option types, up to 8 instances may be selected.
Options
-a audit_id Selects audit records with a matching audit_id. The default is to select for all audit_id's.
-b Outputs selected records in binary format. The output is in a format suitable for analysis by the The default is to output in
ASCII format.
-B Outputs selected records in an abbreviated format. Each selected event is displayed along with its audit_id, ruid, result,
error code, pid, event name, and parameter list. Suppressed information includes the username, ppid, device id, current direc-
tory, gnode information, symbolic name referenced by any descriptors, IP address, and timestamp. The default is to output in
the non-abbreviated format.
-d filename Reads deselection rules from the specified file and suppress any records matching any of the deselection rules. The deselec-
tion rulesets take precedence over other selection options. Each deselection rule is a tuple consisting of hostname, audit_id,
ruid, event, pathname, and flag. The flag component is used to specify read or write mode; it pertains only to open events.
Wildcarding and simple pattern matching are supported. Take, for example, the following lines from a deselection file:
# HOST, AUID, RUID, EVENT, PATHNAME, FLAG
* * * open /usr/lib/* r
grumpy * * * /usr/spool/rwho* *
These lines indicate that any open operations for read access on any object whose pathname starts with will not be selected,
and on system grumpy any operations performed on any object whose pathname starts on will not be selected. (Lines beginning
with number signs (#) are treated as comment lines). Any field can be replaced with an asterisk (*), which indicates a match
with any value. Pathname matching requires an exact match between strings, unless the pathname is suffixed with an asterisk,
which matches any string (so, for example, matches The default is to apply no deselection rulesets. (Specifying the option
instead of will additionally print the deselection rulesets to be applied).
-e event[:success:fail]
Selects records with a matching event. Optionally select only those records with a successful/failed return value. For exam-
ple, the option selects for only failed open events. Multiple events may be specified on the command line. The default is to
select for all events, both successful and failed.
-E error Selects records with a matching error. The default is to select for all errors.
-f Causes the not to quit at and end-of-file, but to continue attempting to read data. This is useful for reviewing auditlog data
as it is being written by the audit daemon. (For SMP systems, audit data should be sorted first, as descriptor translation,
loginname, current directory, and root directory all rely on state information maintained by the
-g gnode_id Selects records with a matching gnode identifier number. The default is to select for all gnode id's.
-G gnode_dev major#,minor#
Selects records with matching gnode device major/minor numbers. The default is to select for all gnode devices.
-h hostname/IP address
Selects records with a matching hostname or IP address. Hostnames are translated to their IP addresses via the local file. If
the local is not available or contains insufficient information, IP addresses should be used. The default is to select for all
hostnames and IP addresses.
-i Enter interactive selection mode to specify options. Interactive mode may also be entered by hitting CTRL/C at any time, then
specifying ``no'' to the exit prompt. Once in interactive mode, each option will be selected for. Press Return to accept the
current setting (or default); enter an asterisk (*) to change the current setting back to the default. The default, unless
otherwise stated, is to select every audit record.
-o Whenever the audit daemon switches auditlogs, an audit_log_change event is generated. If that event did result in an auditlog
change (that is, it was an event which occurred on the local system), the will normally attempt to find and process the suc-
ceeding auditlog. This is possible, however, only if the auditlog is maintained locally. The -o option tells the not to
process succeeding auditlogs.
-p pid Selects records with a matching pid. The default is to select for all pids.
-P ppid Selects records with a matching parent pid (ppid). The default is to select for all ppids.
-r ruid Selects records with a matching read uid (ruid). The default is to select for all ruids.
-R Generates an ASCII report for each audit_id found in the selected events. Each report consists of those events selected which
have an audit_id matching that of report suffix. Report names are of the format report.xxxx, where xxxx is the audit_id.
-s string Selects records which contain string in either a parameter field or a descriptor field. The default is to select for all
strings.
-S Performs a sort (by time) on the auditlog. The sort performed is an inter-cpu sort only (for any specific cpu, data may be
non-sequential for events such as fork and vfork; this information does not need to be sorted for proper operation of the
reduction tool). This option is useful only for data collected on an SMP system.
-t start_time
Selects records which contain a timestamp no earlier than start_time. Timestamp format is yymmdd[hh[mm[ss]]]. The default is
to select for all timestamps.
-T end_time Selects records which contain a timestamp no later than start_time. Timestamp format is yymmdd[hh[mm[ss]]]. The default is to
select for all timestamps.
-u uid Selects audit records with a matching uid. The default is to select for all uid's.
-U username Selects audit records with a matching username. Usernames are recorded at the login event and are associated with all child
processes. If login is not audited, no username will be present in the auditlog. Selecting for a username will display those
records which have a matching username. The default is to select for all usernames.
-x major#,minor#
Selects audit records with matching device major/minor numbers. The default is to select for all devices.
The audit reduction tool generates auditlog header files, suffixed with .hdr, when it completes processing of a auditlog file. If the -o
option is used, no auditlog header file is generated. This header file contains the time range in which the audited operations occurred,
so searching for events by time requires only those auditlogs which were actually written into during that time to be processed by the
reduction tool. The header file also contains the sort status of the auditlog, so previously sorted logs don't get sorted more than once.
Restrictions
The audit reduction tool maintains the state of each process in order to translate descriptors back to pathnames, as well as provide cur-
rent working directory, root, and username. In order not to run out of memory, should be an audited event. In order to provide current
working directory, should be an audited event. In order to provide current root (if not /), should be an audited event. In order to pro-
vide username, login should be an audited event.
All state relevant information current at the time of an auditlog change is maintained in the header file. This allows subsequent scans of
a specific auditlog to not have any dependencies on previous auditlogs.
Examples
The following example selects all login, open and creat events performed on system grumpy by any process with audit_id 1123:
audit_tool -e login -e open -e creat -h grumpy -a 1123 auditlog.000
The following example applies deselection file deselect to auditlog.000 and selects for events between 10:47 a.m. on April 13, 1986 and
5:30 p.m. on April 20, 1986:
audit_tool -d deselect -t 8604131047 -T 8604201730 auditlog.000
See Also
auditd(8), auditmask(8)
audit_tool(8)