Unit 8: Logs and the timeline · Lesson 7 of 8 · 18 min

Who did it: reading the audit trail

Turn the audit log into sentences and prove which login made each change on 13 October.

mission

You are
You are confirming the timeline with a second source.
Situation
auth.log says omar ran commands through sudo. The audit log records the files those commands changed.
Goal
List every change by omar's login and every denied attempt.
Hand in
A table: time, file, program, original user.

Two IDs on every audit record

  1. Login as omarauid is set to 1002 at login
  2. sudouid becomes 0
  3. Write a fileThe record keeps both
  4. Reportomar, acting as root
01

Everything omar's login touched

learner@root-lab
ausearch -if /var/log/audit/audit.log -ua 1002 --format text
At 22:38:50 10/13/26 omar, acting as root, successfully opened-file /etc/passwd using /usr/sbin/useradd
At 22:38:50 10/13/26 omar, acting as root, successfully opened-file /etc/shadow using /usr/sbin/useradd
At 22:42:30 10/13/26 omar, acting as root, successfully opened-file /etc/profile.d/proxy.sh using /usr/bin/tee
At 22:44:02 10/13/26 omar, acting as root, successfully opened-file /etc/cron.d/.sync-check using /usr/bin/tee
At 22:45:10 10/13/26 omar, acting as root, successfully opened-file /etc/systemd/system/kthreadd-helper.service using /usr/bin/tee

you should see Five changes, each made as root but traced back to omar.

defender tip auid is set at login and survives sudo and su. That is why the audit trail still names omar.

02

Denied attempts

learner@root-lab
ausearch -if /var/log/audit/audit.log --success no --format text
At 09:20:44 10/14/26 dana unsuccessfully opened-file /etc/sudoers.d/dana using /usr/bin/tee

you should see dana tried to write a sudoers file the next morning and was refused.

03

Raw fields for the cron change

learner@root-lab
ausearch -if /var/log/audit/audit.log -k cron | grep -oE ' (auid|uid|comm|exe|key)=[^ ]+' | sed 's/^ //'
auid=1002
uid=0
comm="tee"
exe="/usr/bin/tee"
key="cron"

you should see auid=1002 even though uid=0.

Two logs, one evening

auth.log
sudo: omar : COMMAND=/usr/bin/tee /etc/cron.d/.sync-check

What was asked for

audit.log
omar, acting as root, opened-file /etc/cron.d/.sync-check using /usr/bin/tee

What was actually changed

What a defender takes away

  1. 1Confirm a timeline from two sources.
  2. 2Audit denied attempts too; they show intent.
  3. 3Ship audit logs off the box with the rest.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.