中文
devexamples
← Recipes

阅读中文版本

Enable auditd execve Rules

Add audit rules that record process execution on sensitive hosts so unexpected commands leave an auditable trail.

~30 minsecuritylinuxaudit

Task

Configure auditd to log execve calls on production hosts with keyed rules.

When to use this

A host is suspected of compromise, but there is no record of what commands ran, only shell history that is easily edited.

Prerequisites

  • auditd installed and running
  • Root access
  • A central log collector

Steps

1. Add an audit rule keyed to execve.

sudo auditctl -a always,exit -F arch=b64 -S execve -k exec_audit
echo '-a always,exit -F arch=b64 -S execve -k exec_audit' | sudo tee /etc/audit/rules.d/exec.rules

Expected output: Process launches are recorded with a searchable key and survive reboot.

2. Search the audit trail for a command.

sudo ausearch -k exec_audit -ts recent | aureport -x | head

Expected output: The recent executable report shows what ran, when, and by which user.

Troubleshooting

Problem

Log volume explodes

Solution

Scope rules to sensitive paths or commands and forward to a collector with retention limits.

Problem

Rules lost after reboot

Solution

Persist rules in /etc/audit/rules.d and ensure augenrules is run.

Limitations

  • High volume can fill disks.
  • Audit logs are only as trustworthy as their protection.
  • Does not capture file contents unless configured.

What this recipe does

Configure auditd to log execve calls on production hosts with keyed rules.

A host is suspected of compromise, but there is no record of what commands ran, only shell history that is easily edited.

Prerequisites

  • auditd installed and running
  • Root access
  • A central log collector

Procedure

  1. Add an audit rule keyed to execve.
sudo auditctl -a always,exit -F arch=b64 -S execve -k exec_audit
echo '-a always,exit -F arch=b64 -S execve -k exec_audit' | sudo tee /etc/audit/rules.d/exec.rules

Expected result: Process launches are recorded with a searchable key and survive reboot.

  1. Search the audit trail for a command.
sudo ausearch -k exec_audit -ts recent | aureport -x | head

Expected result: The recent executable report shows what ran, when, and by which user.

How to confirm it worked

Run the commands above and confirm every expected result in order. If a step does not produce the stated output, use the troubleshooting notes before continuing. A passing run shows running a command produces a searchable audit record keyed exec_audit attributed to the user.

Troubleshooting

Log volume explodes — Scope rules to sensitive paths or commands and forward to a collector with retention limits.

Rules lost after reboot — Persist rules in /etc/audit/rules.d and ensure augenrules is run.

Limitations

  • High volume can fill disks.
  • Audit logs are only as trustworthy as their protection.
  • Does not capture file contents unless configured.