Audit log emails not going to the correct address

J'e

7/27/24, 9:54 PM

On Ubuntu 20, I'm trying to send audit logs to destination@example.com. I do have a real domain and email server but I'm redacting them here. When I trigger an audit event, the email is instead sent to root on the local machine. So far I've tried the following:

Running echo "Subject: test" | sendmail -f root@my_machine.com destination@example.com the test email is sent successfully.
/etc/audit/auditd.conf has been modified to replace action_mail_acct = root with action_mail_acct = destination@example.com
After modifying auditd.conf, I restarted it using service auditd restart

I don't see any relevent errors in:

/var/log/mail.err
/var/log/mail.log

::: update :::

With the action_email_acct set to a real account, I then ran sudo ls in a terminal to generate an audit event that I can see in /var/log/audit/audit.log. Should I be seeing the audit event here if it's supposed to be emailed?

116

1 + 1

ubuntu

postfix

sendmail

auditd

James T

8/21/24, 3:25 AM

Do you get any interesting log information from running: `journalctl -r -t auditd `

Score:3

Server

Esa Jokinen

8/12/24, 3:48 PM

The action_mail_acct is not for sending audit alerts but for giving notifications about low disk space (below space_left or admin_space_left) when space_left_action or admin_space_left_action is configured to email. From auditd.conf(5):

space_left_action

This parameter tells the system what action to take when the system has detected that it is starting to get low on disk space. Valid values are ignore, syslog, rotate, email, exec, suspend, single, and halt. If set to ignore, the audit daemon does nothing. syslog means that it will issue a warning to syslog. rotate will rotate logs, losing the oldest to free up space. email means that it will send a warning to the email account specified in action_mail_acct as well as sending the message to syslog. exec /path-to-script will execute the script. - -

admin_space_left_action

This parameter tells the system what action to take when the system has detected that it is low on disk space. Valid values are ignore, syslog, rotate, email, exec, suspend, single, and halt. If set to ignore, the audit daemon does nothing. syslog means that it will issue a warning to syslog. rotate will rotate logs, losing the oldest to free up space. email means that it will send a warning to the email account specified in action_mail_acct as well as sending the message to syslog. - -

+ 1

J'e

8/17/24, 3:07 PM

sorry for the confusion, I updated my question to reflect the correct key "...acct" and also added a bounty.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Audit log emails not going to the correct address

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.