Provided by: auditd_1.7.18-1ubuntu1_amd64 bug

NAME

       ausearch - a tool to query audit daemon logs

SYNOPSIS

       ausearch [options]

DESCRIPTION

       ausearch  is  a  tool  that  can  query  the  audit  daemon logs based for events based on
       different search criteria. The ausearch utility can also take input from stdin as long  as
       the input is the raw log data. Each commandline option given forms an "and" statement. For
       example, searching with -m and -ui means return events that have both the  requested  type
       and  match the user id given. An exception is the -n option; multiple nodes are allowed in
       a search which will return any matching node.

       It should also be noted that each syscall excursion from user space into  the  kernel  and
       back  into  user  space  has  one  event  ID  that  is unique. Any auditable event that is
       triggered during this trip share this ID so that they may be correlated.

       Different parts of the kernel may add supplemental records. For example, an audit event on
       the  syscall  "open"  will also cause the kernel to emit a PATH record with the file name.
       The ausearch utility will present all records that make up one event together. This  could
       mean  that  even though you search for a specific kind of record, the resulting events may
       contain SYSCALL records.

       Also be aware that not all record types have the requested  information.  For  example,  a
       PATH record does not have a hostname or a loginuid.

OPTIONS

       -a, --event audit-event-id
              Search  for  an  event  based  on  the  given  event ID. Messages always start with
              something like msg=audit(1116360555.329:2401771). The event ID is the number  after
              the ':'. All audit events that are recorded from one application's syscall have the
              same audit event ID. A second syscall made by the  same  application  will  have  a
              different event ID. This way they are unique.

       -c, --comm comm-name
              Search for an event based on the given comm name. The comm name is the executable's
              name from the task structure.

       -e, --exit exit-code-or-errno
              Search for an event based on the given syscall exit code or errno.

       -f, --file file-name
              Search for an event based on the given filename.

       -ga, --gid-all all-group-id
              Search for an event with either effective group ID or group ID matching  the  given
              group ID.

       -ge, --gid-effective effective-group-id
              Search for an event with the given effective group ID or group name.

       -gi, --gid group-id
              Search for an event with the given group ID or group name.

       -h, --help
              Help

       -hn, --host host-name
              Search  for  an  event  with  the  given  host  name.  The hostname can be either a
              hostname, fully qualified domain name, or numeric network address.  No  attempt  is
              made to resolve numeric addresses to domain names or aliases.

       -i, --interpret
              Interpret  numeric  entities  into  text.  For example, uid is converted to account
              name. The conversion is done using the current resources of the machine  where  the
              search  is  being  run.  If  you  have renamed the accounts, or don't have the same
              accounts on your machine, you could get misleading results.

       -if, --input file-name
              Use the given file instead of the logs. This is to aid analysis where the logs have
              been moved to another machine or only part of a log was saved.

       --input-logs
              Use  the  log file location from auditd.conf as input for searching. This is needed
              if you are using ausearch from a cron job.

       --just-one
              Stop after emitting the first event that matches the search criteria.

       -k, --key key-string
              Search for an event based on the given key string.

       -l, --line-buffered
              Flush output on every line. Most useful when stdout is connected to a pipe and  the
              default block buffering strategy is undesirable. May impose a performance penalty.

       -m, --message message-type | comma-sep-message-type-list
              Search  for  an  event  matching the given message type. You may also enter a comma
              separated list of message types. There is an ALL message type that doesn't exist in
              the actual logs. It allows you to get all messages in the system. The list of valid
              messages types is long. The program will display the list whenever no message  type
              is  passed  with this parameter. The message type can be either text or numeric. If
              you enter a list, there can be only commas and no spaces separating the list.

       -n, --node node-name
              Search for events originating from node name string. Multiple  nodes  are  allowed,
              and if any nodes match, the event is matched.

       -o, --object SE-Linux-context-string
              Search for event with tcontext (object) matching the string.

       -p, --pid process-id
              Search for an event matching the given process ID.

       -pp, --ppid parent-process-id
              Search for an event matching the given parent process ID.

       -r, --raw
              Output  is  completely  unformatted. This is useful for extracting records that can
              still be interpretted by audit tools.

       -sc, --syscall syscall-name-or-value
              Search for an event matching the given syscall. You may  either  give  the  numeric
              syscall  value  or  the syscall name. If you give the syscall name, it will use the
              syscall table for the machine that you are using.

       -se, --context SE-Linux-context-string
              Search for event with  either  scontext/subject  or  tcontext/object  matching  the
              string.

       --session Login-Session-ID
              Search  for  events  matching the given Login Session ID. This process attribute is
              set when a user logs in and can tie any process to a particular user login.

       -su, --subject SE-Linux-context-string
              Search for event with scontext (subject) matching the string.

       -sv, --success success-value
              Search for an event matching the given success value. Legal values are yes and no.

       -te, --end [end-date] [end-time]
              Search for events with time stamps equal to or  before  the  given  end  time.  The
              format  of  end  time  depends  on  your  locale.  If the date is omitted, today is
              assumed. If the time is omitted, now is assumed. Use 24 hour clock time rather than
              AM  or  PM  to  specify  time.  An  example  date  using  the  en_US.utf8 locale is
              09/03/2009. An example of time is 18:00:00. The date format accepted is  influenced
              by the LC_TIME environmental variab le.

              You  may  also  use  the  word: now, recent, today, yesterday, this-week, week-ago,
              this-month, this-year.  Today  means  starting  now.  Recent  is  10  minutes  ago.
              Yesterday  is  1 second after midnight the previous day. This-week means starting 1
              second after midnight on  day  0  of  the  week  determined  by  your  locale  (see
              localtime).  This-month  means  1  second  after  midnight  on  day 1 of the month.
              This-year means the 1 second after midnight on the first day of the first month.

       -ts, --start [start-date] [start-time]
              Search for events with time stamps equal to or after the given end time. The format
              of  end  time  depends on your locale. If the date is omitted, today is assumed. If
              the time is omitted, midnight is assumed. Use 24 hour clock time rather than AM  or
              PM  to  specify time. An example date using the en_US.utf8 locale is 09/03/2009. An
              example of time is 18:00:00. The date format accepted is influenced by the  LC_TIME
              environmental variable.

              You  may  also  use the word: now, recent, today, yesterday, this-week, this-month,
              this-year. Today means starting at 1 second after midnight. Recent  is  10  minutes
              ago.  Yesterday  is  1  second  after  midnight  the  previous day. This-week means
              starting 1 second after midnight on day 0 of the week  determined  by  your  locale
              (see  localtime).  This-month  means 1 second after midnight on day 1 of the month.
              This-year means the 1 second after midnight on the first day of the first month.

       -tm, --terminal terminal
              Search for an event matching the given terminal value. Some daemons  such  as  cron
              and atd use the daemon name for the terminal.

       -ua, --uid-all all-user-id
              Search for an event with either user ID, effective user ID, or login user ID (auid)
              matching the given user ID.

       -ue, --uid-effective effective-user-id
              Search for an event with the given effective user ID.

       -ui, --uid user-id
              Search for an event with the given user ID.

       -ul, --loginuid login-id
              Search for an event with the given login user ID. All entry point programs that are
              pamified  need  to  be  configured  with  pam_loginuid required for the session for
              searching on loginuid (auid) to be accurate.

       -v, --version
              Print the version and exit

       -w, --word
              String based matches must match the whole word. This category of  matches  include:
              filename, hostname, terminal, and SE Linux context.

       -x, --executable executable
              Search for an event matching the given executable name.

SEE ALSO

       auditd(8), pam_loginuid(8).