<div dir="ltr">Someone might look for this info in the future...<div><br></div><div><div>AUDIT_ADD_GROUP " User space group added "</div><div>AUDIT_ADD_USER " User space user account added "</div><div>
AUDIT_ANOM_ABEND " Process ended abnormally "</div><div>AUDIT_ANOM_ACCESS_FS Access of file or dir</div><div>AUDIT_ANOM_ADD_ACCT Adding an acct</div><div>AUDIT_ANOM_AMTU_FAIL AMTU failure</div><div>AUDIT_ANOM_CRYPTO_FAIL Crypto system test failure</div>
<div>AUDIT_ANOM_DEL_ACCT Deleting an acct</div><div>AUDIT_ANOM_EXEC Execution of file</div><div>AUDIT_ANOM_LOGIN_ACCT Login attempted to watched acct</div><div>AUDIT_ANOM_LOGIN_FAILURES Failed login limit reached</div>
<div>AUDIT_ANOM_LOGIN_LOCATION Login from forbidden location</div><div>AUDIT_ANOM_LOGIN_SESSIONS Max concurrent sessions reached</div><div>AUDIT_ANOM_LOGIN_TIME Login attempted at bad time</div><div>AUDIT_ANOM_MAX_DAC Max DAC failures reached</div>
<div>AUDIT_ANOM_MAX_MAC Max MAC failures reached</div><div>AUDIT_ANOM_MK_EXEC Make an executable</div><div>AUDIT_ANOM_MOD_ACCT Changing an acct</div><div>AUDIT_ANOM_PROMISCUOUS " Device changed promiscuous mode "</div>
<div>AUDIT_ANOM_RBAC_FAIL RBAC self test failure</div><div>AUDIT_ANOM_RBAC_INTEGRITY_FAIL RBAC file integrity failure</div><div>AUDIT_ANOM_ROOT_TRANS User became root</div><div>AUDIT_AVC " SE Linux avc denial or grant "</div>
<div>AUDIT_AVC_PATH " dentry, vfsmount pair from avc "</div><div>AUDIT_BPRM_FCAPS " Information about fcaps increasing perms "</div><div>AUDIT_CAPSET " Record showing argument to sys_capset "</div>
<div>AUDIT_CHGRP_ID " User space group ID changed "</div><div>AUDIT_CHUSER_ID " Changed user ID supplemental data "</div><div>AUDIT_CONFIG_CHANGE " Audit system configuration change "</div>
<div>AUDIT_CRED_ACQ " User space credential acquired "</div><div>AUDIT_CRED_DISP " User space credential disposed "</div><div>AUDIT_CRED_REFR " User space credential refreshed "</div><div>
AUDIT_CRYPTO_FAILURE_USER " Fail decrypt,encrypt,randomiz "</div><div>AUDIT_CRYPTO_KEY_USER " Create,delete,negotiate "</div><div>AUDIT_CRYPTO_LOGIN " Logged in as crypto officer "</div>
<div>AUDIT_CRYPTO_LOGOUT " Logged out from crypto "</div><div>AUDIT_CRYPTO_PARAM_CHANGE_USER " Crypto attribute change "</div><div>AUDIT_CRYPTO_REPLAY_USER " Crypto replay detected "</div>
<div>AUDIT_CRYPTO_SESSION " Record parameters set during</div><div>AUDIT_CRYPTO_TEST_USER " Crypto test results "</div><div>AUDIT_CWD " Current working directory "</div><div>AUDIT_DAC_CHECK " User space DAC check results "</div>
<div>AUDIT_DAEMON_ABORT " Daemon error stop record "</div><div>AUDIT_DAEMON_ACCEPT " Auditd accepted remote connection "</div><div>AUDIT_DAEMON_CLOSE " Auditd closed remote connection "</div>
<div>AUDIT_DAEMON_CONFIG " Daemon config change "</div><div>AUDIT_DAEMON_END " Daemon normal stop record "</div><div>AUDIT_DAEMON_RESUME " Auditd should resume logging "</div><div>AUDIT_DAEMON_ROTATE " Auditd should rotate logs "</div>
<div>AUDIT_DAEMON_START " Daemon startup record "</div><div>AUDIT_DEL_GROUP " User space group deleted "</div><div>AUDIT_DEL_USER " User space user account deleted "</div><div>AUDIT_EOE " End of multi-record event "</div>
<div>AUDIT_EXECVE " execve arguments "</div></div><div><div>AUDIT_FD_PAIR " audit record for pipe</div><div>AUDIT_FS_RELABEL " Filesystem relabeled "</div><div>AUDIT_GRP_AUTH " Authentication for group password "</div>
<div>AUDIT_INTEGRITY_DATA #ifndef AUDIT_INTEGRITY_DATA " Data integrity verification " " Data integrity verification "</div><div>AUDIT_INTEGRITY_HASH " Integrity HASH type " " Integrity HASH type "</div>
<div>AUDIT_INTEGRITY_METADATA " Metadata integrity verification "</div><div>AUDIT_INTEGRITY_PCR " PCR invalidation msgs " " PCR invalidation msgs "</div><div>AUDIT_INTEGRITY_RULE " Policy rule " " policy rule "</div>
<div>AUDIT_INTEGRITY_STATUS " Integrity enable status " " Integrity enable status "</div><div>AUDIT_IPC " IPC record "</div><div>AUDIT_IPC_SET_PERM " IPC new permissions record type "</div>
<div>AUDIT_KERNEL " Asynchronous audit record. NOT A REQUEST. "</div><div>AUDIT_KERNEL_OTHER " For use by 3rd party modules "</div><div>AUDIT_LABEL_LEVEL_CHANGE " Object's level was changed "</div>
<div>AUDIT_LABEL_OVERRIDE " Admin is overriding a label "</div><div>AUDIT_LOGIN " Define the login id and information "</div><div>AUDIT_MAC_CIPSOV4_ADD " NetLabel: add CIPSOv4 DOI entry "</div>
<div>AUDIT_MAC_CIPSOV4_DEL " NetLabel: del CIPSOv4 DOI entry "</div><div>AUDIT_MAC_CONFIG_CHANGE " Changes to booleans "</div><div>AUDIT_MAC_IPSEC_ADDSA " Not used "</div><div>AUDIT_MAC_IPSEC_ADDSPD " Not used "</div>
<div>AUDIT_MAC_IPSEC_DELSA " Not used "</div><div>AUDIT_MAC_IPSEC_DELSPD " Not used "</div><div>AUDIT_MAC_IPSEC_EVENT " Audit an IPSec event "</div><div>AUDIT_MAC_MAP_ADD " NetLabel: add LSM domain mapping "</div>
<div>AUDIT_MAC_MAP_DEL " NetLabel: del LSM domain mapping "</div><div>AUDIT_MAC_POLICY_LOAD " Policy file load "</div><div>AUDIT_MAC_STATUS " Changed enforcing,permissive,off "</div><div>
AUDIT_MAC_UNLBL_STCADD " NetLabel: add a static label "</div><div>AUDIT_MAC_UNLBL_STCDEL " NetLabel: del a static label "</div><div>AUDIT_MMAP #ifndef AUDIT_MMAP " Descriptor and flags in mmap " " Record showing descriptor and flags in mmap "</div>
<div>AUDIT_MQ_GETSETATTR " POSIX MQ get</div><div>AUDIT_MQ_NOTIFY " POSIX MQ notify record type "</div><div>AUDIT_MQ_OPEN " POSIX MQ open record type "</div><div>AUDIT_MQ_SENDRECV " POSIX MQ send</div>
<div>AUDIT_NETFILTER_CFG #ifndef AUDIT_NETFILTER_CFG " Netfilter chain modifications " " Netfilter chain modifications "</div><div>AUDIT_NETFILTER_PKT #ifndef AUDIT_NETFILTER_PKT " Packets traversing netfilter chains " " Packets traversing netfilter chains "</div>
<div>AUDIT_OBJ_PID " ptrace target "</div><div>AUDIT_PATH " Filename path information "</div><div>AUDIT_RESP_ACCT_LOCK " User acct was locked "</div><div>AUDIT_RESP_ACCT_LOCK_TIMED " User acct locked for time "</div>
<div>AUDIT_RESP_ACCT_REMOTE " Acct locked from remote access"</div><div>AUDIT_RESP_ACCT_UNLOCK_TIMED " User acct unlocked from time "</div><div>AUDIT_RESP_ALERT " Alert email was sent "</div>
<div>AUDIT_RESP_ANOMALY " Anomaly not reacted to "</div><div>AUDIT_RESP_EXEC " Execute a script "</div><div>AUDIT_RESP_HALT " take the system down "</div><div>AUDIT_RESP_KILL_PROC " Kill program "</div>
<div>AUDIT_RESP_SEBOOL " Set an SE Linux boolean "</div><div>AUDIT_RESP_SINGLE " Go to single user mode "</div><div>AUDIT_RESP_TERM_ACCESS " Terminate session "</div></div><div><div>AUDIT_RESP_TERM_LOCK " Terminal was locked "</div>
<div>AUDIT_ROLE_ASSIGN " Admin assigned user to role "</div><div>AUDIT_ROLE_MODIFY " Admin modified a role "</div><div>AUDIT_ROLE_REMOVE " Admin removed user from role "</div><div>AUDIT_SELINUX_ERR " Internal SE Linux Errors "</div>
<div>AUDIT_SERVICE_START " Service (daemon) start "</div><div>AUDIT_SERVICE_STOP " Service (daemon) stop "</div><div>AUDIT_SOCKADDR " sockaddr copied as syscall arg "</div><div>AUDIT_SYSTEM_BOOT " System boot "</div>
<div>AUDIT_SYSTEM_RUNLEVEL " System runlevel change "</div><div>AUDIT_SYSTEM_SHUTDOWN " System shutdown "</div><div>AUDIT_TEST " Used for test success messages "</div><div>AUDIT_TRUSTED_APP " Trusted app msg - freestyle text "</div>
<div>AUDIT_TTY " Input on an administrative TTY "</div><div>AUDIT_USER " Message from userspace -- deprecated "</div><div>AUDIT_USER_ACCT " User space acct change "</div><div>AUDIT_USER_AUTH " User space authentication "</div>
<div>AUDIT_USER_AVC " User space avc message " " We filter this differently "</div><div>AUDIT_USER_CHAUTHTOK " User space acct attr changed "</div><div>AUDIT_USER_CMD " User shell command and args "</div>
<div>AUDIT_USER_END " User space session end "</div><div>AUDIT_USER_ERR " User space acct state err "</div><div>AUDIT_USER_LABELED_EXPORT " Object exported with label "</div><div>AUDIT_USER_LOGIN " User space user has logged in "</div>
<div>AUDIT_USER_LOGOUT " User space user has logged out "</div><div>AUDIT_USER_MAC_POLICY_LOAD " Userspc daemon loaded policy "</div><div>AUDIT_USER_MGMT " User space acct management "</div>
<div>AUDIT_USER_ROLE_CHANGE " User changed to a new role "</div><div>AUDIT_USER_SELINUX_ERR " SE Linux user space error "</div><div>AUDIT_USER_START " User space session start "</div><div>
AUDIT_USER_TTY " Non-ICANON TTY input meaning " " Non-ICANON TTY input meaning "</div><div>AUDIT_USER_UNLABELED_EXPORT " Object exported without label "</div><div>AUDIT_USYS_CONFIG " User space system config change "</div>
<div>AUDIT_VIRT_CONTROL " Start, Pause, Stop VM "</div><div>AUDIT_VIRT_MACHINE_ID " Binding of label to VM "</div><div>AUDIT_VIRT_RESOURCE " Resource assignment "</div></div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Apr 8, 2014 at 4:47 PM, Satish Chandra Kilaru <span dir="ltr"><<a href="mailto:iam.kilaru@gmail.com" target="_blank">iam.kilaru@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Thank you.</div><div class="gmail_extra"><div><div class="h5"><br><br><div class="gmail_quote">On Tue, Apr 8, 2014 at 4:41 PM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On Tuesday, April 08, 2014 10:53:40 AM Satish Chandra Kilaru wrote:<br>
> Hi<br>
><br>
> I want to understand the logs in /var/log/audit/audit.log. Where can I get<br>
> complete list of audit event types<br>
<br>
</div>ausearch -m help 2>&1 | tr ' ' '\n' | egrep '^[A-Z]' | egrep -v 'ALL|Valid' | sort<br>
<br>
> and what they mean?<br>
<br>
Each event type has some comment in the header files /usr/include/libaudit.h<br>
and /usr/include/linux/audit.h. There is also some documentation here:<br>
<br>
<a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Understanding_Audit_Log_Files.html" target="_blank">https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Understanding_Audit_Log_Files.html</a><br>
<br>
And I want to think some other distros have docs as well.<br>
<span><font color="#888888"><br>
-Steve<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div></div></div><div class="">-- <br>Please Donate to <a href="http://www.wikipedia.org" target="_blank">www.wikipedia.org</a>
</div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Please Donate to <a href="http://www.wikipedia.org">www.wikipedia.org</a>
</div>