3

How to install auditd on CentOS 6.4 x64 ? I want to Log all commands run by admins Log all commands run by admins on production servers Edit: I can't run aduditd service

I did with this tut enter link description here

sudo yum install audit
sudo chkconfig auditd on

Added these 2 lines to /etc/audit/audit.rules

-a exit,always -F arch=b64 -F euid=0 -S execve
-a exit,always -F arch=b32 -F euid=0 -S execve

I ran some commands and there is no auditd directory for log in /var/log/

Now auditd don't work i can't get running service. In messages log i get this

Sep  7 18:05:40 vesoljedomen auditd[6777]: Started dispatcher: /sbin/audispd pid: 6779
Sep  7 18:05:40 vesoljedomen audispd: No plugins found, exiting
Sep  7 18:05:40 vesoljedomen auditd[6777]: Unable to set audit pid, exiting
Sep  7 18:05:40 vesoljedomen auditd: Cannot daemonize (Success)
Sep  7 18:05:40 vesoljedomen auditd: The audit daemon is exiting.
Sep  7 18:05:40 vesoljedomen auditd[6777]: The audit daemon is exiting.
Sep  7 18:05:47 vesoljedomen auditd[6791]: Started dispatcher: /sbin/audispd pid: 6793
Sep  7 18:05:47 vesoljedomen audispd: No plugins found, exiting
Sep  7 18:05:47 vesoljedomen auditd[6791]: Unable to set audit pid, exiting
Sep  7 18:05:47 vesoljedomen auditd: Cannot daemonize (Success)
Sep  7 18:05:47 vesoljedomen auditd: The audit daemon is exiting.
Sep  7 18:05:47 vesoljedomen auditd[6791]: The audit daemon is exiting.
Sep  7 18:06:01 vesoljedomen auditd[6924]: Started dispatcher: /sbin/audispd pid: 6926
Sep  7 18:06:01 vesoljedomen audispd: No plugins found, exiting
Sep  7 18:06:01 vesoljedomen auditd[6924]: Unable to set audit pid, exiting
Sep  7 18:06:01 vesoljedomen auditd: Cannot daemonize (Success)
Sep  7 18:06:01 vesoljedomen auditd: The audit daemon is exiting.
Sep  7 18:06:01 vesoljedomen auditd[6924]: The audit daemon is exiting.


-bash-4.1# -bash-4.1# chkconfig --list | grep auditd
-bash: -bash-4.1#: command not found
-bash-4.1# auditd          0:off   1:off   2:on    3:on    4:on    5:on    6:off
Usage: auditd [-f] [-l] [-n] [-s disable|enable|nochange]
-bash-4.1# -bash-4.1# service auditd status
-bash: -bash-4.1#: command not found
-bash-4.1# service auditd start
-bash-4.1# auditd is stopped
Community
  • 1
Luka Tce
  • 37

1 Answers1

2

Directory is called /var/log/audit/ not /var/log/auditd/

If missing, then someone deleted that directory, run sudo yum reinstall audit to recreate it.

audit is installed by default and running, anyway, run sudo service auditd start

Note:

I want to Log all commands run by admins Log all commands run by admins on production servers

auditd won't help always you with that, it can't log everything, especially when logs are stored on the same machine.

GioMac
  • 4,754