7.8. Creating Audit Reports
7.8. Creating Audit Reports The aureport utility allows you to generate summary and columnar reports on the events recorded in Audit log files. By default, all audit.log files in the /var/log/audit/ directory are queried to create the report. You can specify a different file to run the report against using the aureport options -if file_name command. Example 7.8. Using aureport to Generate Audit Reports To generate a report for logged events in the past three days excluding the current example day, use the following command: To generate a report of all executable file events, use the following command: To generate a summary of the executable file event report above, use the following command: To generate a summary report of failed events for all users, use the following command: To generate a summary report of all failed login attempts per each system user, use the following command: To generate a report from an ausearch query that searches all file access events for user ID 1000 , use the following command: To generate a report of all Audit files that are queried and the time range of events they include, use the following command: For a full listing of all aureport options, see the aureport (8) man page.
~]# aureport --start 04/08/2013 00:00:00 --end 04/11/2013 00:00:00 ~]# aureport -x ~]# aureport -x --summary ~]# aureport -u --failed --summary -i ~]# aureport --login --summary -i ~]# ausearch --start today --loginuid 1000 --raw | aureport -f --summary ~]# aureport -t