7.7. Searching the Audit Log Files

The ausearch utility allows you to search Audit log files for specific events. By default, ausearch searches the /var/log/audit/audit.log file. You can specify a different file using the ausearch options -if file_name command. Supplying multiple options in one ausearch command is equivalent to using the AND operator between field types and the OR operator between multiple instances of the same field type.

~]# ausearch --message USER_LOGIN --success no --interpret

~]# ausearch -m ADD_USER -m DEL_USER -m ADD_GROUP -m USER_CHAUTHTOK -m DEL_GROUP -m CHGRP_ID -m ROLE_ASSIGN -m ROLE_REMOVE -i

~]# ausearch -ua 1000 -i

~]# ausearch --start yesterday --end now -m SYSCALL -sv no -i

For a full listing of all ausearch options, see the ausearch(8) man page.