Hello all, I joined the mailing list but have not received the confirmation email yet. Please include me in the reply if you don't mind.
Okay here goes. I must have a simple misunderstanding or I may be doing something wrong. When I do the below three commands the auid shown back to me is not the same from all the commands, but it's the same event. In the first aureport I'm getting back an auid of zero for root. In the second aureport I get back my teammate's auid. Also in the ausearch for the specific event I get my teammate's auid. I would expect my teammate's auid across all but that's not what I see. It seems the first aureport replaces the auid with uid. Can anyone point me in the right direction to get my expected results working? I'm happy to share audit.rules and/or PAM configuration, although they appear to be the result of someone following the standard security guidelines. The Red Hat support people have pointed me to "Chapter 7. System Auditing" which I am happy to read. However, I already stumbled upon "7.8. Creating Audit Reports" and I didn't see anything that helped me out. Here are the commands. $ sudo aureport -l -ts 04/13/2016 17:02:06 -te 04/13/2016 17:02:06 Login Report ============================================ # date time auid host term exe success event ============================================ 1. 04/13/2016 17:02:06 0 10.120.1.235 /dev/pts/2 /usr/sbin/sshd yes 1972315 $ sudo aureport -l --summary -ts 04/13/2016 17:02:06 -te 04/13/2016 17:02:06 Login Summary Report ============================ total auid ============================ 1 849603 $ sudo ausearch --message USER_LOGIN -ts 04/13/2016 17:02:06 -te 04/13/2016 17:02:06 ---- time->Wed Apr 13 17:02:06 2016 type=USER_LOGIN msg=audit(1460581326.375:1972315): user pid=29792 uid=0 auid=849603 ses=4572 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=849603 exe="/usr/sbin/sshd" hostname=10.120.1.235 addr=10.120.1.235 terminal=/dev/pts/2 res=success' V/r, Bryan -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
