Configuring Log Visualization - Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual

5 Use the event ID to get a detailed record for each item of interest:
TIP: Focusing on a Certain Time Frame
If you are interested in events during a particular period of time, trim down
the reports by using start and end dates and times with your aureport com-
mands (-ts and -te). For more information, refer to
ating Custom Audit Reports"
All steps except for the last one can be run automatically and would easily be scriptable
and configured as cron jobs. Any of the --failed --summary reports could be
transformed easily into a bar chart that plots files versus failed access attempts. For
more information about visualizing audit report data, refer to
Log Visualization"

31.6 Configuring Log Visualization

Using the scripts mkbar and mkgraph you can illustrate your audit statistics with
various graphs and charts. As with any other aureport command, the plotting com-
mands are scriptable and can easily be configured to run as cron jobs.
380 Security Guide
aureport -f -i --failed |grep -e "/etc/audit/auditd.conf" -e
"/etc/pam.d/" -e "/etc/sysconfig"
993. 17/02/09 16:47:34 /etc/sysconfig/displaymanager readlink no
/bin/vim-normal root 7887
994. 17/02/09 16:48:23 /etc/sysconfig/displaymanager getxattr no
/bin/vim-normal root 7889
ausearch -a 7887 -i
----
time->Tue Feb 17 16:48:23 2009
type=PATH msg=audit(1234885703.090:7889): item=0
name="/etc/sysconfig/displaymanager" inode=369282 dev=08:06 mode=0100644
ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1234885703.090:7889):
type=SYSCALL msg=audit(1234885703.090:7889): arch=c000003e syscall=191
success=no exit=-61 a0=7e1e20 a1=7f90e4cf9187 a2=7fffed5b57d0 a3=84
items=1 ppid=25548 pid=23045 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=pts2 ses=1166 comm="vim" exe="/bin/vim-normal"
key=(null)
(page 380).
(page 357).
cwd="/root"
Section 30.5.2, "Gener-
Section 31.6, "Configuring