Unit 8: Logs and the timeline · Lesson 7 of 8 · 18 min

Who did it: reading the audit trail

Turn the audit log into sentences and prove which login made each change on 13 October.

mission

You are
You are confirming the timeline with a second source.
Situation
auth.log says omar ran commands through sudo. The audit log records the files those commands changed.
Goal
List every change by omar's login and every denied attempt.
Hand in
A table: time, file, program, original user.

Two IDs on every audit record

  1. Login as omarauid is set to 1002 at login
  2. sudouid becomes 0
  3. Write a fileThe record keeps both
  4. Reportomar, acting as root
01

Everything omar's login touched

learner@root-lab
ausearch -if /var/log/audit/audit.log -ua 1002 --format text
At 22:38:50 10/13/26 omar, acting as root, successfully opened-file /etc/passwd using /usr/sbin/useradd
At 22:38:50 10/13/26 omar, acting as root, successfully opened-file /etc/shadow using /usr/sbin/useradd
At 22:42:30 10/13/26 omar, acting as root, successfully opened-file /etc/profile.d/proxy.sh using /usr/bin/tee
At 22:44:02 10/13/26 omar, acting as root, successfully opened-file /etc/cron.d/.sync-check using /usr/bin/tee
At 22:45:10 10/13/26 omar, acting as root, successfully opened-file /etc/systemd/system/kthreadd-helper.service using /usr/bin/tee

you should see Five changes, each made as root but traced back to omar.

defender tip auid is set at login and survives sudo and su. That is why the audit trail still names omar.

ausearch
Searches the Linux audit log. Install with sudo apt install auditd, or brew install auditd on a Mac.
02

Denied attempts

learner@root-lab
ausearch -if /var/log/audit/audit.log --success no --format text
At 09:20:44 10/14/26 dana unsuccessfully opened-file /etc/sudoers.d/dana using /usr/bin/tee

you should see dana tried to write a sudoers file the next morning and was refused.

03

Raw fields for the cron change

learner@root-lab
ausearch -if /var/log/audit/audit.log -k cron | grep -oE ' (auid|uid|comm|exe|key)=[^ ]+' | sed 's/^ //'
auid=1002
uid=0
comm="tee"
exe="/usr/bin/tee"
key="cron"

you should see auid=1002 even though uid=0.

grep
Prints the lines of text that match a pattern. Built into Linux and macOS.
comm
Compares two sorted files and shows the lines unique to each, or shared. Built into Linux and macOS.
sed
Edits text as it streams past, for example to replace or delete lines. Built into Linux and macOS.

Two logs, one evening

auth.log
sudo: omar : COMMAND=/usr/bin/tee /etc/cron.d/.sync-check

What was asked for

audit.log
omar, acting as root, opened-file /etc/cron.d/.sync-check using /usr/bin/tee

What was actually changed

What a defender takes away

  1. 1Confirm a timeline from two sources.
  2. 2Audit denied attempts too; they show intent.
  3. 3Ship audit logs off the box with the rest.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.