audit logs not getting generated.
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 692
- PR merge metrics
- No merged PRs in 30d
Description
Version
VMware Photon Linux 1.0
PHOTON_BUILD_NUMBER=13c08b6
I see the following folder
/etc/audit
and in there i see audit.conf, audit.rules files . The audit.rules have many rules listed .
But even with this, I am not seeing any logs in the /var/log/audit/audit.log
The only content in the audit.log file is as below:
type=DAEMON_ROTATE msg=audit(1552879981.763:4333): op=rotate-logs auid=? pid=? subj=?
type=DAEMON_CONFIG msg=audit(1552890927.050:8845) op=reconfigure state=changed auid=0 pid=1 subj=? res=success
I restarted the auditd service by service auditd restart and then checked the status of the auditd service, which shows auditd is running. But still after this, there are not logs in /var/log/audit/audit.log
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with /etc/audit/audit.conf and /etc/audit/audit.rules, then inspect the auditd service status and the existing entries in /var/log/audit/audit.log. Reproduce an auditable system action and determine why expected events are not recorded; done means audit.log contains the expected audit events after auditd is restarted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100