Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 364

30.5.1 Understanding the Audit Logs
The following examples highlight two typical events that are logged by audit and how
their trails in the audit log are read. The audit log or logs (if log rotation is enabled) are
stored in the /var/log/audit directory. The first example is a simple less com-
mand. The second example covers a great deal of PAM activity in the logs when a user
tries to remotely log in to a machine running audit.
Example 30.7 A Simple Audit Event—Viewing the Audit Log
type=SYSCALL msg=audit(1234874638.599:5207): arch=c000003e syscall=2
success=yes exit=4 a0=62fb60 a1=0 a2=31 a3=0 items=1 ppid=25400 pid
=25616 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1
ses=1164 comm="less" exe="/usr/bin/less" key="doc_log"
type=CWD msg=audit(1234874638.599:5207):
type=PATH msg=audit(1234874638.599:5207): item=0
name="/var/log/audit/audit.log" inode=1219041 dev=08:06 mode=0100644 ouid=0
ogid=0 rdev=00:00
The above event, a simple less /var/log/audit/audit.log, wrote three
messages to the log. All of them are closely linked together and you would not be able
to make sense of one of them without the others. The first message reveals the following
information:
type
The type of event recorded. In this case, it assigns the SYSCALL type to an event
triggered by a system call (less or rather the underlying open). The CWD event was
recorded to record the current working directory at the time of the syscall. A PATH
event is generated for each path passed to the system call. The open system call
takes only one path argument, so only generates one PATH event. It is important
to understand that the PATH event reports the pathname string argument without
any further interpretation, so a relative path requires manual combination with the
path reported by the CWD event to determine the object accessed.
msg
A message ID enclosed in brackets. The ID splits into two parts. All characters
before the : represent a UNIX epoch time stamp. The number after the colon rep-
resents the actual event ID. All events that are logged from one application's system
call have the same event ID. If the application makes a second system call, it gets
another event ID.
352 Security Guide
cwd="/root"