Practical Linux Security Cookbook - Second Edition

Using ausearch and aureport to read logs

In the previous section, we have seen how the auditd tool can be used to define rules and keep watch on particular files and directories.

To retrieve data from the auditd log files, we can use the ausearch tool and by using aureport, we can generate reports based on these logs.

ausearch is a command-line tool that is used to search the log files of the auditd daemon on the basis of events and other search criteria.

Similary, aureport is also a command-line tool that helps in creating useful summary reports from the log files of the audidt daemon.