Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 377

In both cases, use a command similar to the following:
ausearch -a 5207
----
time->Tue Feb 17 13:43:58 2009
type=PATH msg=audit(1234874638.599:5207): item=0
name="/var/log/audit/audit.log" inode=1219041 dev=08:06 mode=0100644 ouid=0
ogid=0 rdev=00:00
type=CWD msg=audit(1234874638.599:5207):
type=SYSCALL msg=audit(1234874638.599:5207): arch=c000003e syscall=2
success=yes exit=4 a0=62fb60 a1=0 a2=31 a3=0 items=1 ppid=25400 pid=25616
auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1
ses=1164 comm="less" exe="/usr/bin/less" key="doc_log"
The ausearch -a command grabs all records in the logs that are related to the
audit event ID provided and displays them. This option cannot be combined with
any other option.
Search by Message Type
To search for audit records of a particular message type, use the ausearch -m
message_type command. Examples of valid message types include PATH,
SYSCALL, and USER_LOGIN. Running ausearch -m without a message type
displays a list of all message types.
Search by Login ID
To view records associated with a particular login user ID, use the ausearch
-ul command. It displays any records related to the user login ID specified pro-
vided that user had been able to log in successfully.
Search by User ID
View records related to any of the user IDs (both user ID and effective user ID)
with ausearch -ua. View reports related to a particular user ID with ausearch
-ui uid. Search for records related to a particular effective user ID, use the
ausearch -ue euid. Searching for a user ID means the user ID of the user
creating a process. Searching for an effective user ID means the user ID and privi-
leges that are required to run this process.
Search by Group ID
View records related to any of the group IDs (both group ID and effective group
ID) with the ausearch -ga command. View reports related to a particular user
ID with ausearch -gi gid. Search for records related to a particular effective
group ID, use ausearch -ge egid.
cwd="/root"
Understanding Linux Audit 365