시스템을 감시하는 데몬으로 설정된 Rule에 의해 로그를 기록한다.
audit로인해 생성된 로그파일은 aureport에 의해 보고서를 생성해 확인가능하다.
1,2번은 테스트를 위해 SSH 접속 시도해본 로그이며 3번은 제3자에 의해 접속을 시도한 로그입니다.
# aureport --help
usage: aureport [options]
-a,--avc Avc report
-au,--auth Authentication report
-c,--config Config change report
-cr,--crypto Crypto report
-e,--event Event report
-f,--file File name report
--failed only failed events in report
-h,--host Remote Host name report
--help help
-i,--interpret Interpretive mode
-if,--input <Input File name> use this file as input
--input-logs Use the logs even if stdin is a pipe
-l,--login Login report
-k,--key Key report
-m,--mods Modification to accounts report
-ma,--mac Mandatory Access Control (MAC) report
--node <node name> Only events from a specific node
-n,--anomaly aNomaly report
-p,--pid Pid report
-r,--response Response to anomaly report
-s,--syscall Syscall report
--success only success events in report
--summary sorted totals for main object in report
-t,--log Log time range report
-te,--end [end date] [end time] ending date & time for reports
-tm,--terminal TerMinal name report
-ts,--start [start date] [start time] starting data & time for reports
--tty Report about tty keystrokes
-u,--user User name report
-v,--version Version
-x,--executable eXecutable name report
If no report is given, the summary report will be displayed
