Questions tagged [audit]
The audit tag has no summary.
171 questions
2 votes
0 answers
135 views
Getting a large number of type=1400 apparmor=ALLOWED dmesg lines
My dmesg log is littered with the following kind of lines: [ +0.000009] audit: type=1400 audit(1745688898.020:223710): apparmor="ALLOWED" operation="getattr" class="file"...
- 11.1k
1 vote
1 answer
603 views
dmesg log being flooded by audit, can I somehow prevent it?
I'm torrenting with Transmission GTK. My dmesg log is being flooded by audit, and without knowing what good it is for, I do not even care much, I cannot use dmesg for other purposes. It floods so fast ...
- 31.3k
0 votes
1 answer
323 views
auditd logs- /lib/ld-linux-x86-64.so.2 flooding logs
I am running auditd on a Debian 11 server with a very generic set of audit rules. The audit log is filled with entries like below. I'm not sure what they are - can anyone help identify these? I'm ...
- 15
1 vote
1 answer
190 views
Force tcsh to check whether command exist in the path before attempting to execute it
I've noticed that tcsh, regardless of whether "-f" flag is passed on the shebang line, will iterate through $PATH, and try to execute the command from that path until the command is found. ...
- 164
0 votes
1 answer
3k views
audit rule doesn't load via systemctl restart auditd
I was trying to see what was enabling ipv4 forwarding in file /proc/sys/net/ipv4/ip_forward (I've discovered that this was docker, but I'd still like to understand my auditd issue) So I decided to ...
- 91
0 votes
1 answer
70 views
Users setup with misspelled name - CentOS 8
I have a user with a misspelled username on my CentOS 8 system which I thought I had corrected but I have noticed the username is showing up in the audit log incorrectly. The correct username is: ...
- 1
1 vote
2 answers
1k views
Linux How to find the id of a user who ran some particular command using sudo [duplicate]
In shared environment where multiple users have sudo account, I want to find out underlying user id (not a sudo account) details who has invoked particular script. Thanks. I tried below but it does ...
- 11
0 votes
0 answers
657 views
Audit Logging Discrepancy: Journald vs Rsyslog
After installing Debian 12 and rsyslog 8.2302 (for TLS remote syslog), I noticed that apparmor logs (or any audit logs) were not being sent remotely. After reviewing the local system, journald DOES ...
user432564