Enterprise Cloud Security and Governance

First field

In the above log sample file there are certain key components that we need to understand. Let's take a look into those:

• comm: This field tells us which command was run to analyze the file. In our case, it was a cat.
• auid: This is the user id of the user who executed the command to analyze the file.
• success = yes: This tells us if the command was executed successfully. In our case, it is yes. If he would have had the permission denied, then this success field would have been no.

So, from the preceding fields, we can determine that the user with ID 1000 was able to successfully read the file associated with the key (credit-file) with the cat command at the particular timestamp.

We can also run the ausearch command to generate ...