LinuxAuditToBSM [FreeBSD WIKI]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Linux Audit to BSM conversion ======

===== audit-userspace =====

[[https://github.com/linux-audit/audit-userspace|audit-userspace on GitHub]]

==== Hints ====
  * Some fields have their //type// defined in ''%%auparse/typetab.h%%''.

==== Understanding a field step by step ====

  - Choose your field.
  - Find it in the [[https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv|field dictionary]] to get any idea what it is.
  - Find out if it is listed in ''%%auparse/typetab.h%%'' to learn its type. 

You can also run ''%%grep -RI -C 2 *tab.h%%'' in ''%%auparse%%''; your field might be listed in one of those files.

===== Structure =====

  * A Linux Audit log file is made of events.
  * An event is made of records which share the same timestamp and id.
  * A record has a type, a timestamp, an id and an arbitrary number of fields.
  * A field has a name and a value. It looks like this: name=value.

===== Resources =====
==== General ====
  * [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Understanding_Audit_Log_Files.html|Understanding Linux Audit log files with Red Hat.]]
  * [[https://www.digitalocean.com/community/tutorials/how-to-use-the-linux-auditing-system-on-centos-7|Digital Ocean tutorial.]]
  * [[https://github.com/linux-audit/audit-documentation/wiki|The official Linux Audit documentation.]]
  * [[https://github.com/linux-audit/audit-documentation/wiki/SPEC-Writing-Good-Events#fields|Some more definitions and information about the Linux Audit standard.]]
  * [[https://people.redhat.com/sgrubb/audit/audit-parse.txt|A file with Linux Audit event parsing library specifications.]]
  * [[http://people.redhat.com/sgrubb/audit/|The official (one of many?) website of Linux Audit.]]
  * [[https://people.redhat.com/sgrubb/audit/event-enrichment|The enriched format.]]

==== Log files ====
  * [[https://www.redhat.com/archives/linux-audit/2005-May/msg00151.html|Some ancient (2005) Linux Audit log examples.]]
  * [[https://groups.google.com/forum/#!topic/fluentd/yMooaGMbGj8|Some logs from 2014.]]
  * [[http://linoxide.com/how-tos/auditd-tool-security-auditing/|An article about basic usage of Linux auditd with some example logs.]]
  * [[http://unix.stackexchange.com/questions/283587/restart-a-service-through-apache|Example logs from 2016.]]
  * [[http://whmcr.com/2011/10/14/auditd-logging-all-commands/|Logs with an a4 field.]]

==== Structure ====
=== Linux Audit event field ===
  * [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/app-Audit_Reference.html#sec-Audit_Events_Fields|List of the available names for Linux Audit event fields (by Red Hat).]]
  * [[https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv|A dictionary of available Linux Audit fields.]]

=== Linux Audit event record ===
  * [[https://github.com/linux-audit/audit-userspace/blob/master/lib/msg_typetab.h|Source file with a list of available types of Linux Audit records.]]
  * [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Audit_Record_Types.html|Audit record types list in the Red Hat documentation.]]

==== Related threads on linux-audit redhat com mailing list. ====

  * [[https://www.redhat.com/archives/linux-audit/2016-July/msg00063.html|Questions about the standard.]]
  * [[https://www.redhat.com/archives/linux-audit/2016-July/msg00103.html|How can I install the latest version of Linux Audit on CentOS 6.8?]]
  * [[https://www.redhat.com/archives/linux-audit/2016-August/msg00018.html|How can I install the latest version of Linux Audit on CentOS 7 (improved)?]]
  * [[https://www.redhat.com/archives/linux-audit/2016-July/msg00117.html|Why does the res field has a value of 1 instead of either success or fail.]]
  * [[https://www.redhat.com/archives/linux-audit/2016-August/msg00000.html|Question about the a[[:digit: + \[.*\  fields.]]