Linux auditd Log Analysis Guide

In this tutorial, you'll learn about Linux auditd Log Analysis Guide. We cover key concepts, practical examples, and best practices.

Linux auditd generates audit logs tracking security-relevant events, but the raw logs in /var/log/audit/audit.log are difficult to read. You need the right tools and queries to extract meaningful information from millions of audit records.

The Problem

sudo cat /var/log/audit/audit.log | head -5

Shows:

type=SYSCALL msg=audit(1623456789.123:456): arch=c000003e syscall=2 success=yes exit=3 ...
type=AVC msg=audit(1623456790.456:457): avc:  denied  { read } for  pid=1234 ...
type=LOGIN msg=audit(1623456791.789:458): pid=5678 uid=0 old-auid=4294967295 auid=1000 ...

These raw records are cryptic and hard to filter without the right tools.

Wrong Approach

# WRONG — grepping raw logs without context
sudo grep "denied" /var/log/audit/audit.log

Right Approach

# Use ausearch for structured queries
sudo ausearch -m avc -ts today

Expected output:

time->Wed 24 Jun 2026 10:30:00 AM UTC type=AVC msg=audit(1623456789.123:456): avc: denied { read } for pid=1234 comm="nginx" name="index.html" dev="sda1" ino=56789 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file

## Step-by-Step Analysis

### Step 1: Check total audit log size

```bash
sudo ausearch --total

Step 2: Search for specific event types

# AVC denials (SELinux)
sudo ausearch -m avc -ts today

# Login events
sudo ausearch -m LOGIN -ts yesterday

# File watch events
sudo ausearch -m PATH -ts today

Step 3: Query by time range

sudo ausearch -ts 10:00:00 -te 11:00:00

Step 4: Query by user ID

sudo ausearch -ui 1000 -ts today

Step 5: Query by executable

sudo ausearch -x /usr/sbin/nginx -ts today

Step 6: Generate summary reports

sudo aureport -m -ts today
sudo aureport -l -ts today
sudo aureport -u -ts today

Step 7: Watch specific files

Add a watch rule:

sudo auditctl -w /etc/shadow -p wa -k shadow-watch

Make permanent:

echo "-w /etc/shadow -p wa -k shadow-watch" | sudo tee -a /etc/audit/rules.d/security.rules
sudo systemctl restart auditd

Step 8: Search by watch key

sudo ausearch -k shadow-watch -ts today

Prevention Tips

• Set up file watches for critical system files: /etc/shadow, /etc/passwd, /etc/ssh/sshd_config
• Use aureport daily to generate security summaries
• Forward audit logs to a central SIEM for long-term retention
• Limit audit log size with max_log_file in /etc/audit/auditd.conf
• Test audit rules with auditctl -l to verify they are active

Common Mistakes with auditd logs

1. Mixing let bindings with <- bindings in do notation, producing type errors
2. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors
3. Non-exhaustive pattern matches that compile with warnings then crash at runtime

These mistakes appear frequently in real-world LINUX code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ