Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Appendix B. Audit System Reference

B.1. Audit Event Fields
Copiar enlace

Table B.1, “Event Fields” lists all currently-supported Audit event fields. An event field is the value preceding the equal sign in the Audit log files.
Expand
Table B.1. Event Fields
Event Field Explanation
a0, a1, a2, a3Records the first four arguments of the system call, encoded in hexadecimal notation.
acctRecords a user's account name.
addrRecords the IPv4 or IPv6 address. This field usually follows a hostname field and contains the address the host name resolves to.
archRecords information about the CPU architecture of the system, encoded in hexadecimal notation.
auidRecords the Audit user ID. This ID is assigned to a user upon login and is inherited by every process even when the user's identity changes (for example, by switching user accounts with su - john).
capabilityRecords the number of bits that were used to set a particular Linux capability. For more information on Linux capabilities, see the capabilities(7) man page.
cap_fiRecords data related to the setting of an inherited file system-based capability.
cap_fpRecords data related to the setting of a permitted file system-based capability.
cap_peRecords data related to the setting of an effective process-based capability.
cap_piRecords data related to the setting of an inherited process-based capability.
cap_ppRecords data related to the setting of a permitted process-based capability.
cgroupRecords the path to the cgroup that contains the process at the time the Audit event was generated.
cmdRecords the entire command line that is executed. This is useful in case of shell interpreters where the exe field records, for example, /bin/bash as the shell interpreter and the cmd field records the rest of the command line that is executed, for example helloworld.sh --help.
commRecords the command that is executed. This is useful in case of shell interpreters where the exe field records, for example, /bin/bash as the shell interpreter and the comm field records the name of the script that is executed, for example helloworld.sh.
cwdRecords the path to the directory in which a system call was invoked.
dataRecords data associated with TTY records.
devRecords the minor and major ID of the device that contains the file or directory recorded in an event.
devmajorRecords the major device ID.
devminorRecords the minor device ID.
egidRecords the effective group ID of the user who started the analyzed process.
euidRecords the effective user ID of the user who started the analyzed process.
exeRecords the path to the executable that was used to invoke the analyzed process.
exitRecords the exit code returned by a system call. This value varies by system call. You can interpret the value to its human-readable equivalent with the following command: ausearch --interpret --exit exit_code
familyRecords the type of address protocol that was used, either IPv4 or IPv6.
filetypeRecords the type of the file.
flagsRecords the file system name flags.
fsgidRecords the file system group ID of the user who started the analyzed process.
fsuidRecords the file system user ID of the user who started the analyzed process.
gidRecords the group ID.
hostnameRecords the host name.
icmptype Records the type of a Internet Control Message Protocol (ICMP) package that is received. Audit messages containing this field are usually generated by iptables.
idRecords the user ID of an account that was changed.
inodeRecords the inode number associated with the file or directory recorded in an Audit event.
inode_gidRecords the group ID of the inode's owner.
inode_uidRecords the user ID of the inode's owner.
itemsRecords the number of path records that are attached to this record.
keyRecords the user defined string associated with a rule that generated a particular event in the Audit log.
listRecords the Audit rule list ID. The following is a list of known IDs:
  • 0 — user
  • 1 — task
  • 4 — exit
  • 5 — exclude
modeRecords the file or directory permissions, encoded in numerical notation.
msgRecords a time stamp and a unique ID of a record, or various event-specific <name>=<value> pairs provided by the kernel or user space applications.
msgtypeRecords the message type that is returned in case of a user-based AVC denial. The message type is determined by D-Bus.
nameRecords the full path of the file or directory that was passed to the system call as an argument.
new-diskRecords the name of a new disk resource that is assigned to a virtual machine.
new-memRecords the amount of a new memory resource that is assigned to a virtual machine.
new-vcpuRecords the number of a new virtual CPU resource that is assigned to a virtual machine.
new-netRecords the MAC address of a new network interface resource that is assigned to a virtual machine.
new_gidRecords a group ID that is assigned to a user.
oauid Records the user ID of the user that has logged in to access the system (as opposed to, for example, using su) and has started the target process. This field is exclusive to the record of type OBJ_PID.
ocommRecords the command that was used to start the target process.This field is exclusive to the record of type OBJ_PID.
opidRecords the process ID of the target process. This field is exclusive to the record of type OBJ_PID.
osesRecords the session ID of the target process. This field is exclusive to the record of type OBJ_PID.
ouidRecords the real user ID of the target process
objRecords the SELinux context of an object. An object can be a file, a directory, a socket, or anything that is receiving the action of a subject.
obj_gidRecords the group ID of an object.
obj_lev_highRecords the high SELinux level of an object.
obj_lev_lowRecords the low SELinux level of an object.
obj_roleRecords the SELinux role of an object.
obj_uidRecords the UID of an object
obj_userRecords the user that is associated with an object.
ogidRecords the object owner's group ID.
old-diskRecords the name of an old disk resource when a new disk resource is assigned to a virtual machine.
old-memRecords the amount of an old memory resource when a new amount of memory is assigned to a virtual machine.
old-vcpuRecords the number of an old virtual CPU resource when a new virtual CPU is assigned to a virtual machine.
old-netRecords the MAC address of an old network interface resource when a new network interface is assigned to a virtual machine.
old_promRecords the previous value of the network promiscuity flag.
ouidRecords the real user ID of the user who started the target process.
pathRecords the full path of the file or directory that was passed to the system call as an argument in case of AVC-related Audit events
permRecords the file permission that was used to generate an event (that is, read, write, execute, or attribute change)
pid
The pid field semantics depend on the origin of the value in this field.
In fields generated from user-space, this field holds a process ID.
In fields generated by the kernel, this field holds a thread ID. The thread ID is equal to process ID for single-threaded processes. Note that the value of this thread ID is different from the values of pthread_t IDs used in user-space. For more information, see the gettid(2) man page.
ppidRecords the Parent Process ID (PID).
promRecords the network promiscuity flag.
protoRecords the networking protocol that was used. This field is specific to Audit events generated by iptables.
resRecords the result of the operation that triggered the Audit event.
resultRecords the result of the operation that triggered the Audit event.
saddrRecords the socket address.
sauidRecords the sender Audit login user ID. This ID is provided by D-Bus as the kernel is unable to see which user is sending the original auid.
sesRecords the session ID of the session from which the analyzed process was invoked.
sgidRecords the set group ID of the user who started the analyzed process.
sigRecords the number of a signal that causes a program to end abnormally. Usually, this is a sign of a system intrusion.
subjRecords the SELinux context of a subject. A subject can be a process, a user, or anything that is acting upon an object.
subj_clrRecords the SELinux clearance of a subject.
subj_roleRecords the SELinux role of a subject.
subj_senRecords the SELinux sensitivity of a subject.
subj_userRecords the user that is associated with a subject.
successRecords whether a system call was successful or failed.
suidRecords the set user ID of the user who started the analyzed process.
syscallRecords the type of the system call that was sent to the kernel.
terminalRecords the terminal name (without /dev/).
ttyRecords the name of the controlling terminal. The value (none) is used if the process has no controlling terminal.
uidRecords the real user ID of the user who started the analyzed process.
vmRecords the name of a virtual machine from which the Audit event originated.
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat