I tried to watch my adhoc alert.log file with auditd, but I don't know why it does not work.
I found no related entries in the auditd.log file.
# auditctl -w /tmp/alert1.log -p wa -k alert
#
# auditctl -l
-a never,task
-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change
-a always,exit -F arch=b32 -S stime,settimeofday,adjtimex -F key=time-change
-a always,exit -F arch=b64 -S clock_settime -F key=time-change
-a always,exit -F arch=b32 -S clock_settime -F key=time-change
-w /tmp/alert1.log -p wa -k alert
echo alert >> /tmp/alert1.log
Also tried to monitor logger activity with this:
-w /bin/logger -p x -k LOGGER_CALL
But it seems that it generates an alert only once, when I use the logger again, then the next logger alert is not watched/logged.
...EDIT
I found some strange behavior,
It works only when I use just these two rules>
-w /usr/bin/logger -p x -k LOGGER_CALL
-w /tmp/alert.log -p wa -k alert
But when I use also with other rules, then it not worked,
Can some other rules override my rules ?
Another strange behavior > When I just clean / modify rules and restart auditd, it still is not working, I have to reboot the whole server .
Here are all the rules, where it did not work within.
-a task,never
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
-w /var/log/sudo.log -p wa -k actions
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /etc/selinux/ -p wa -k MAC-policy
-w /usr/share/selinux/ -p wa -k MAC-policy
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/sysconfig/network -p wa -k system-locale
-w /etc/sysconfig/network-scripts/ -p wa -k system-locale
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
-w /usr/bin/logger -p x -k LOGGER_CALL
-w /tmp/alert.log -p wa -k alert
