2.Processes the command line arguments.
3.Attempts to raise its resource limits.
4.Sets its umask.
5.Resets its internal counters.
6.Emits a title.
7.Processes audit records from an audit log file or stdin, incrementing counters depending on audit record contents.
8.Prints a message and exits if there are no useful events.
9.Prints a summary report.
10.Destroys its data structures and frees memory.
11.Exits.
5.15.2.2ausearch
Only root has the ability to run this tool. First, ausearch checks the validity of the parameters passed, whether they are supported or not. Then, it opens either the logs or the
After that, ausearch starts to process the records one record at a time, matching on the parameters passed to it. Because each audit record can be written into the log as multiple file records, the tool collates all the file records into a linked list before it checks whether the record matches the requested search criteria.
5.15.2.3autrace
Only root can run this command. autrace executes the program passed to it after setting a filter to audit all system calls for the new process. If any rules or watches were previously set, autrace will not run; it requires that all rules and watches be cleared first. For more information on autrace, see the autrace(8) man page.
5.15.3Audit configuration files
See Section 5.6.2.1 Configuration for more detail on audit configuration files.
5.15.4Audit logs
LAF audit logs, also known as audit trails, are the final repository of audit records generated by the kernel and the trusted programs. An administrative user can use the ausearch on audit logs to extract and analyze
Audit logs are protected by their DAC mode, in order to protect them from unauthorized deletion or modification.
An administrator can specify in the auditd.conf file what actions auditd should perform whenever audit logs reach a specified size. Also, the administrator can specify what happens when writing to the audit logs encounters an error.
212
