<html><head></head><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:16px"><div><span></span></div><div></div><div id="yui_3_16_0_ym19_1_1462868852243_3398">Hi Steve,</div><div id="yui_3_16_0_ym19_1_1462868852243_3396"><br></div><div id="yui_3_16_0_ym19_1_1462868852243_3375">Thanks for your suggestions. We incorporated the below rule for auditctl which you suggested, but unfortunately it didn't helped. We are able to log the wget from the same server but unfortunately it is still not logging from a different host:</div><div id="yui_3_16_0_ym19_1_1462868852243_3391"><br></div><div id="yui_3_16_0_ym19_1_1462868852243_3577" dir="ltr">-a always,exit -F path=/a/b/c/xyz.log -F perm=r -F key=log-access</div><div id="yui_3_16_0_ym19_1_1462868852243_3468" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1462868852243_3576" dir="ltr">This is how the file looks like:</div><div id="yui_3_16_0_ym19_1_1462868852243_3472" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1462868852243_3469" dir="ltr">-w /a/b/c/xyz.log -p rwxa -k Audit</div><div id="yui_3_16_0_ym19_1_1462868852243_3555" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1462868852243_3539" dir="ltr">-w /usr/bin/wget -p rwxa -k Audit</div><div dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1462868852243_3603" dir="ltr">-a always,exit -F path=/a/b/c/xyz.log -F perm=r -F key=log-access</div><div id="yui_3_16_0_ym19_1_1462868852243_3681" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1462868852243_3614" dir="ltr">But nothing is logging the Audit when wget is called from any other host. Can you please assist on this further.</div><div id="yui_3_16_0_ym19_1_1462868852243_3392"><br></div><div class="signature" id="yui_3_16_0_ym19_1_1462868852243_3394"><b>Thanks and Regards,</b><div id="yui_3_16_0_ym19_1_1462868852243_3393"><b>Varun Gulati</b></div><div id="yui_3_16_0_ym19_1_1462868852243_3670"><strong></strong><br></div></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: times new roman, new york, times, serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;"> <div dir="ltr"><font face="Arial" size="2"> On Tuesday, 10 May 2016 1:32 AM, Steve Grubb <sgrubb@redhat.com> wrote:<br></font></div> <br><br> <div class="y_msg_container">On Monday, May 09, 2016 04:13:19 PM varun gulati wrote:<br clear="none">> Hi Team,<br clear="none">> We have requirement where we have to monitor and log any read operations<br clear="none">> performed on a file. e.g. /a/b/c/xyz.log<br clear="none"><br clear="none">-a always,exit -F path=/a/b/c/xyz.log -F perm=r -F key=log-access<br clear="none"><br clear="none"><br clear="none">> This file is usually copied and downloaded by many users using various<br clear="none">> operations, like, wget, ssh, jsp Download link provided. These commands are<br clear="none">> fired from different hosts. With the auditd we want to create a rule which<br clear="none">> auditctl can leverage to log the User ID that is reading (and copying) it<br clear="none">> from a different host may be.<br clear="none"><br clear="none">You will get the local auid/uid that the kernel sees when the request triggers <br clear="none">the rule. There is nothing more that can be done from the audit system.<br clear="none"><br clear="none">-Steve<div class="yqt2440747729" id="yqtfd31864"><br clear="none"><br clear="none"><br clear="none">> I have gone through many of the rules but didn't find anything fruitful as<br clear="none">> such (which logs wget, scp commands from remote hosts). May be I am missing<br clear="none">> on something. Since it is a very crucial requirement, appreciate your<br clear="none">> guidance and directions with this. Let me know in case you require any<br clear="none">> further information from my end. Many thanks in advance.<br clear="none">> <br clear="none">> <br clear="none">> <br clear="none">> Thanks and Regards,Varun Gulati<br clear="none"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>