Red Hat Enterprise Linux 5 Administration Unleashed

516CHAPTER 25Linux Auditing SystemIf the daemon is already running when you modify its configuration, use the serviceauditd restart command as root to enable the changes. To verify that the rules andwatches have been modified, use the auditctl -l command as root to list all active rulesand watches. For example, Listing 25.6 shows the auditctl -l output for the rules andwatches in Listing 25.2 and 25.4.LISTING 25.6Listing Audit Rules and WatchesLIST_RULES: entry,always syscall=chmodLIST_RULES: exit,always uid=501 (0x1f5) key=tfox syscall=openLIST_RULES: exit,always watch=/var/log/audit perm=rwxa key=LOG_AUDITLIST_RULES: exit,always watch=/etc/sysconfig perm=rwxa key=SYSCONFIGLIST_RULES: exit,always watch=/etc/passwd perm=rwxa key=PASSWDLIST_RULES: exit,always watch=/etc/shadow perm=rwxa key=PASSWDLIST_RULES: exit,always watch=/etc/group perm=rwxa key=PASSWDLIST_RULES: exit,always watch=/etc/audit/audit.rules perm=rwxa key=AUDIT_RULESLIST_RULES: exit,always watch=/etc/audit/auditd.conf perm=rwxa key=AUDIT_CONFLIST_RULES: exit,always watch=/usr/bin/vpnc perm=x key=VPNCAnalyzing the RecordsIf auditd is used, audit messages are written to /var/log/audit/audit.log unless the filenameis changed with the log_file parameter in /etc/audit/auditd.conf. The log file isa text file and can be read with the less utility or a text editor such as Emacs or Vi. Themessages are written in the format received from the kernel in the order they are received.The aureport utility can be used to generate summary reports from the log file. Theausearch utility can be used to search for reports based on criteria such as the audit eventID, a filename, UID or GID, message type, and system call name.Unless the daemon is configured to rotate the log files and remove old ones as previouslydescribed in the “Configuring the Audit Daemon” section, the log files in /var/log/audit/ are never removed. Administrators should check the logs frequently and removeold ones or move them to backup storage. If the logs are not removed periodically, theycan fill up the entire disk. Because of this, it is recommended that /var/log/audit/ be aseparate dedicated partition so it does not affect the writing of other log files or causeother system errors.TIPTo force the log file to be rotated immediately, issue the service auditd rotatecommand as root. The old log files will have the filename audit.log.N, where N is anumber. The larger the number, the older the log file.Generating ReportsTo generate reports of the audit messages, use the aureport. The /var/log/audit/ directoryand all the audit log files in it are only readable by the root user for security. Thus,