Linux Audit Log

Background:
Linux operating system If you find a process is not known to be killed and do not know which process was killed, if we do not know can be

Configuration:

1). Root log in and open the Audit.rules file, located under the/etc/audit/folder.
Add the following content:
-A always,exit-f arch=b64-s kill-k *wg934*

Note: If the bad border is 32, please change to-f arch=b32
*wg934* just behind the mark, the aspect of the view with no special meaning

2). Restart ADUITD Service
Service AUDITD Restart

3). View the process number of a process and record it, and when the next time the process is killed, open the Linux audit Log view under Folder/var/log/audit.

Test and Result:

1). Sleep after a long process 22303 kill

[Email protected] audit]#
[Email protected] audit]# sleep 9999999&
[1] 22303
[Email protected] audit]# kill-9 22303
[1]+ killed Sleep 9999999
[Email protected] audit]#

Linux inside can see: opid = Objective pid was killed by the target PID
？ Which syscall=62 why is kill still not clear

Type=syscall Msg=audit (1420632793.383:1410163): arch=c000003e syscall=62 success=yes exit=0 a0=571f a1=9 a2=0 a3=0 Items =0 ppid=23986 pid=24009 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=77492 comm="bash" exe= "/bin/bash" key= "*wg934*"

Type=obj_pid Msg=audit (1420632793.383:1410163): opid=22303 oauid=0 ouid=0 oses=77492 obj=<NULL> ocomm= "Sleep"

Using a script to kill a process is also recorded:

[Email protected] audit]# sleep 999999 &
[1] 714
[email protected] audit]# python 1.py &
[2] 1390
[Email protected] audit]# vim Audit.log
[1]-killed Sleep 999999

1.py

Import OS import timepid= ' 714 'command= ' kill-9 ' + pidos.popen (command) time.sleep (100000000) 

Type=syscall Msg=audit (1420635463.926:1419473): arch=c000003e syscall=62 success=yes exit=0 a0=2ca a1=9 a2=0 a3=0 items= 0 ppid=1390 pid=1391 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=77492 comm="sh" exe="/bin /bash "key=" *wg934* "
Type=obj_pid Msg=audit (1420635463.926:1419473): opid=714 oauid=0 ouid=0 oses=77492 obj=<null> ocomm= "Sleep"

Linux Audit Log