Linux Audit to BSM conversion

audit-userspace on GitHub

• Some fields have their type defined in auparse/typetab.h.

1. Choose your field.
2. Find it in the field dictionary to get any idea what it is.
3. Find out if it is listed in auparse/typetab.h to learn its type.

You can also run grep -RI -C 2 *tab.h in auparse; your field might be listed in one of those files.

• A Linux Audit log file is made of events.
• An event is made of records which share the same timestamp and id.
• A record has a type, a timestamp, an id and an arbitrary number of fields.
• A field has a name and a value. It looks like this: name=value.

• Understanding Linux Audit log files with Red Hat.
• Digital Ocean tutorial.
• The official Linux Audit documentation.
• Some more definitions and information about the Linux Audit standard.
• A file with Linux Audit event parsing library specifications.
• The official (one of many?) website of Linux Audit.
• The enriched format.

• Some ancient (2005) Linux Audit log examples.
• Some logs from 2014.
• An article about basic usage of Linux auditd with some example logs.
• Example logs from 2016.
• Logs with an a4 field.

• List of the available names for Linux Audit event fields (by Red Hat).
• A dictionary of available Linux Audit fields.

• Source file with a list of available types of Linux Audit records.
• Audit record types list in the Red Hat documentation.

• Questions about the standard.
• How can I install the latest version of Linux Audit on CentOS 6.8?
• How can I install the latest version of Linux Audit on CentOS 7 (improved)?
• Why does the res field has a value of 1 instead of either success or fail.
• Question about the a[[:digit: + \[.*\ fields.