This command allows search operations in the audit logs.
Syntax:ausearch <parameters>
Note
For the list of
ausearchcommand parameters, executeausearchcommand in the Manager shell.
Sample output:
IPSManager> ausearch -i -p 1586
----
type=PROCTITLE msg=audit(08/21/19 13:48:03.930:747) : proctitle=/sbin/autrace /usr/bin/df
type=SYSCALL msg=audit(08/21/19 13:48:03.930:747) : arch=x86_64 syscall=close success=yes exit=0 a0=0x4 a1=0x7f2d8cf11760 a2=0x0 a3=0x7f2d8d55ca50 items=0 ppid=1584 pid=1586 auid=admin uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=23 comm=autrace exe=/usr/sbin/autrace subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----
type=PROCTITLE msg=audit(08/21/19 13:48:03.930:748) : proctitle=/sbin/autrace /usr/bin/df
type=SYSCALL msg=audit(08/21/19 13:48:03.930:748) : arch=x86_64 syscall=fstat success=yes exit=0 a0=0x1 a1=0x7ffe4c170da0 a2=0x7ffe4c170da0 a3=0x7ffe4c171020 items=0 ppid=1584 pid=1586 auid=admin uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=23 comm=autrace exe=/usr/sbin/autrace subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)