Syslog - Linux Audit
Device Details
| Device Name | Syslog - Linux Audit |
|---|---|
Vendor | Linux |
Device Type | N/A |
Supported Model Name/Number | N/A |
Supported Software Version(s) | N/A |
Collection Method | Syslog |
Configurable Log Output? | Yes |
Log Source Type | Syslog - Linux Audit |
Log Processing Policy | LogRhythm Default |
Exceptions | N/A |
Additional Information | N/A |
Supported Log Messages
| Type | Product Version | Supported Schema Fields |
|---|---|---|
| Audit Events 1 | N/A | <severity>, <vmid>, <process>, <amount>, <command>, <vendorinfo>, <object>, <objectname> |
| Audit Events 2 | N/A | <vmid>, <subject>, <Account>, <process>, <object>, <tag2>, <tag3>, <group>, <sname>, <Sip>, <session>, <tag1> |
| Callback Suppressed | N/A | <severity>, <process>, <quantity> |
| Catch All : Level 1 | N/A | <severity>, <tag1> |
| Configuration Change | N/A | <severity>, <vmid>, <account>, <session>, <command>, <objectname>, <subject>, <account> |
| Connection Failed | N/A | <severity>, <process>, <processid>, <dname>, <dport> |
| CROND Operations | N/A | <severity>, <dname>, <process>, <processid>, <tag1>, <subject>, <tag2>, <login>, <command> |
| CRONTAB Operations | N/A | <severity>, <dname>, <process>, <processid>, <object> |
| Finished Catalog Run | N/A | <seveirty>, <process>, <processid>, <object>, <seconds> |
| General PCI Information | N/A | <tag1>, <itemsin>, <process>, <account>, <group>, <session>, <object>, <tag2> |
| Group Entry Messages | N/A | <severity>, <dname>, <process>, <object>, <objectname>, <group>, <domain>, <tag1> |
| GSSAPI Messages | N/A | <severity>, <process>, <subject>, <object> |
| Kernel Audit Message | N/A | <severity>, <processid>, <session>, <command>, <dname>, <dip>, <sname>, <subject>, <quantity> |
| Last Message Repeated | N/A | <severity>, <dname>, <subject>, <quantity>, <url>, <protname>, <responsecode> |
| NTPD Event | N/A | <severity>, <dname>, <process>, <processid>, <dip>, <object> |
| Path Information | N/A | <severity>, <object>, <account>, <objectname> |
| Puppet Agent Command Executed Successfully | N/A | <severity>, <dname>, <process>, <processid>, <command> |
| Session Information | N/A | <severity>, <process>, <processid>, <account> |
| SNMPD Operations | N/A | <severity>, <dname>, <process>, <processid>, <tag1>, <command>, <tag2>, <protname>, <sip>, <sport>, <dip>, <subject> |
| System Call Activity | N/A | <severity>, <vmid>, <version>, <command>, <result>, <tag2>, <subject>, <parentprocessid>, <processid>, <login>, <account>, <group>, <session>, <process>, <object>, <objectname> |
| System Call Information | N/A | <severity>, <process>, <account>, <session>, <command>, <object>, <objectname> |
| Systemd : User Logs In | N/A | <severity>, <process>, <subject>, <action>, <object> |
Revision History
| KB Version | Log Type | Change Type | Details |
|---|---|---|---|
| KB 7.1.588.0 | Syslog | Device Support Update |
|