aureport tips — authorized audit-report literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run aureport on the lab host (syllabus box you own; typically needs audit group / root for full logs).
2. Prefer documenting who / why / ticket before any audit-report drill — never scrape production audit logs without change control.
3. Record short factual notes; quote short Evidence (summary counts, event-type labels — never secrets or foreign auth dumps).
4. Optional: search peer → ausearch-tips.
5. Optional: rule peer → auditctl-tips.
6. Prefer disposable lab audit trails for aureport drills; quote non-secret summary counts afterward as Evidence.
7. Prefer read-only aureport --summary / --auth (redacted) for most Evidence binders — avoid inventing log-tamper cookbooks.
8. Stop at literacy — no attack or unauthorized audit-harvest cookbooks.

Allowed framing

• Classroom labs reviewing aureport --summary, --auth, --file literacy on authorized disposable hosts.
• Binding short factual notes as Evidence (summary counts/event types — no secrets).
• Documenting expected vs observed audit-report behaviour for authorized inventory notes.
• Comparing aureport ↔ ausearch / auditctl / getenforce / selinux peer tip pages under one binder.
• Testing syllabus-approved date ranges only when the lab authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via aureport.
• No intentional unauthorized audit-log harvest against foreign hosts.
• No secret-theft or auth-event credential harvesting against hosts you do not own.
• No cookbooks that tamper with or disable audit trails without authorization.
• No attack framing via audit-report dumps.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with auditd / aureport available.
2. Prefer a throwaway lab audit trail before any deep report.
3. With authorization, run aureport --summary; quote non-secret summary counts/event-type labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized harvest cookbooks.

Practical notes for authorized labs

• aureport summarizes audit logs — keep Evidence labels distinct from ausearch-tips event-search drills.
• Pair with auditctl-tips when the syllabus zooms on which rules produced the events.
• Audit logs often embed usernames, paths, and command lines — never paste secrets into notes or git.
• Prefer documenting summary counts the syllabus authorized without dumping full privileged event JSON.
• Never commit aureport dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host audit harvest → refuse.
• Unauthorized audit-tamper / disable cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources