githubmirror/audit-userspace

auparse/test/test3.log
15 строк4 KB
sgrubb
Update tests for the auparse lol patch
07 янв 2016, 18:40
07 янв 2016, 18:4093548fe
node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194435): arch=c000003e syscall=23 success=yes exit=1 a0=c a1=56420184ade0 a2=564201867510 a3=0 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194433): arch=c000003e syscall=13 success=yes exit=0 a0=b a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194433): proctitle="bash"
node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194435): proctitle=737368643A206275726E205B707269765D
node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194436): arch=c000003e syscall=13 success=yes exit=0 a0=1f a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194437): arch=c000003e syscall=14 success=yes exit=0 a0=0 a1=7ffdac6fe9a0 a2=7ffdac6fe920 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194436): proctitle="bash"
node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194437): proctitle=737368643A206275726E205B707269765D
node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194438): arch=c000003e syscall=13 success=yes exit=0 a0=d a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194439): arch=c000003e syscall=14 success=yes exit=0 a0=2 a1=7ffdac6fe920 a2=0 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194439): proctitle=737368643A206275726E205B707269765D
node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194440): arch=c000003e syscall=228 success=yes exit=0 a0=7 a1=7ffdac6fe9c0 a2=564201867510 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194438): proctitle="bash"
node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194440): proctitle=737368643A206275726E205B707269765D
node=auditdtest.a1959.org type=ADD_GROUP msg=audit(1451781471.602:194894): pid=1321 uid=0 auid=1000 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=add-group acct="frodo" exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/0 res=success'