ausearch and aureport - querying the audit log

ausearch and aureport are the query tools for the audit log. ausearch finds specific events; aureport summarises them.

ausearch basics

sudo ausearch -ts today              # all events today
sudo ausearch -ts 08/09/26           # all events on a date
sudo ausearch -ts recent             # last 10 minutes
sudo ausearch -ts 14:00 -ts 16:00    # time range

Filter by user

sudo ausearch -ua 1000                 # by UID
sudo ausearch -ua alice                # by username (resolves to UID)

Filter by file

sudo ausearch -f /etc/passwd
sudo ausearch -f /etc/shadow
sudo ausearch -f /etc/sudoers

Filter by syscall

sudo ausearch -sc execve               # all execve calls
sudo ausearch -sc setuid               # privilege escalation attempts
sudo ausearch -sc connect              # network connections

Filter by key

Keys are tags you set in audit rules:

sudo ausearch -k passwd
sudo ausearch -k sudoers
sudo ausearch -k sshd

Combine filters

# All sudo events for user alice today
sudo ausearch -ua alice -k sudoers -ts today

# All failed setuid attempts in the last hour
sudo ausearch -sc setuid -sv no -ts recent

# File changes by user bob in the last day
sudo ausearch -ua bob -ts recent --file

aureport basics

sudo aureport --summary                # overall summary
sudo aureport --login                  # login events
sudo aureport --comm                   # commands run (there is no --sudo report)
sudo aureport --auth                   # authentication attempts
sudo aureport --file                   # file changes
sudo aureport --syscall                # syscall counts
sudo aureport --failed                 # failed events
sudo aureport --key                    # by rule key
sudo aureport --user                   # by user

Common investigations

Who ran sudo today?

There is no --sudo report — aureport reports by record type, not by command name. The sudo view comes from ausearch on the USER_CMD record type:

sudo ausearch -m USER_CMD -ts today -i        # commands run through sudo
sudo aureport -au -i -ts today                # sudo authentication, pass and fail
sudo ausearch -k privileged -ts today -i      # if your rules tag privileged binaries

-i (--interpret) resolves UIDs, syscall numbers and hex-encoded arguments. Without it the output is unreadable numerics.

Failed logins:

sudo aureport --login -ts today --summary | grep Failed
sudo ausearch -m USER_LOGIN -sv no -ts today

Changes to /etc/passwd:

sudo ausearch -f /etc/passwd -ts today

Privilege escalation attempts:

sudo ausearch -sc setuid -sv no -ts today
sudo ausearch -k privileged -ts today

Interpret the output

ausearch output:

type=SYSCALL msg=audit(1625000000.123:456): ... uid=1000 auid=1000 ...
type=USER_AUTH msg=audit(1625000000.456:457): ... uid=1000 ...

Each line is one event. Multiple lines for the same event have the same audit(...time.sec:seq) value.

aureport output is summarised:

Summary Report
======================
Range of time in logs: 08/09/26 00:00:00 - 23:59:59
Events in range: 12345
Logins: 42
sudo: 156
Failed: 8

Knowledge check