How to Locate and Export Linux auditd Logs
Summary
A practical guide to checking Linux auditd configuration, exporting raw audit logs with ausearch, and retrieving kernel audit events from the journal when auditd is absent.
Key points
- auditd logs are stored in /var/log/audit/audit.log and require root access.
- Use ausearch --raw with time filters to export records in their original format.
- If auditd is absent, query kernel audit events with journalctl _TRANSPORT=audit; available records may be limited.
- Loaded audit rules determine coverage: without execution or file-access rules, those events may not be recorded.
- auditd rotates logs according to max_log_file and num_logs in /etc/audit/auditd.conf.
- A “backlog limit exceeded” message indicates audit events may have been dropped, leaving gaps in the logs.
Article Details
- Defense Focus
- Collecting and reviewing Linux audit events to support host activity detection and investigation.
- Detection Methods
- Use auditctl -l to check which audit rules are loaded; no rules means command-execution and file-access records are not collected.
- Review auditd events for process execution, file access, permission changes, and account changes.
- Use the cited Prime Core rules to detect malicious shell use, planted SSH keys, and permission changes on sensitive files.
- When auditd is unavailable, query kernel audit events in journald and review the available login and SELinux or AppArmor records.
- Data Sources
- Linux auditd records in /var/log/audit/audit.log and rotated audit.log files
- Kernel audit events in journald
- Audit records including SYSCALL, EXECVE, CWD, PATH, and PROCTITLE entries
- Login, authentication, SELinux, and AppArmor events
- Rule Types
- Linux auditd rules
- Raw audit event records
- journald JSON output
- Platforms
- Linux
- Defensive Actions
- Check whether auditd is installed and running, and inspect loaded rules before relying on command-execution or file-access logs.
- Install and enable auditd where appropriate, and start from a known rule set to collect the events needed for detection.
- Export auditd records in raw format with ausearch; if auditd is unavailable, retrieve kernel audit events with journalctl.
- Restrict access to audit logs, which the article notes are root-readable.
- Treat logs as potentially incomplete when kernel messages report “backlog limit exceeded”; the article recommends raising backlog_limit.
MITRE ATT&CK
T1059.004 · Unix ShellThe article cites Prime Core auditd detection rules for malicious shell use.T1098.004 · SSH Authorized KeysThe article cites Prime Core auditd detection rules for planted SSH keys.T1222.002 · Linux and Mac PermissionsThe article cites Prime Core auditd detection rules for permission changes on sensitive files.