Glad to hear that it's working for you now.=C2=A0

Typically, the '-w <path/filename>' syntax is = to watch system files for modification, not so much to audit the execution = of the command (like for power events, as you're doing). The way I audi= t reboot commands (among others) is:

-a always,exit -F arch= =3Db32 -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setrlim= it -S swapon -k reboot_sched_swap
-a always,exit -F arch=3Db64 -S acct -= S reboot -S sched_setparam -S sched_setscheduler -S setrlimit -S swapon -k = reboot_sched_swap

and

-w /var/run/utmp -p wa -k session=

This might not be sufficient for your needs, but hopefully it's= helpful.=C2=A0

Stephen

On Mon, Jan 30, 2017 at 5:21 AM Damian Ty= ka=C5=82owski <d47zm3@gmail.com&= gt; wrote:

I found it out
auditctl -l did not list rule as loaded, I checked logs of auditd = deeper and found it stopped loading rules at some point due to duplicated r= ule, after sorting that out, it loaded all rules correctly, sorry for troub= le

On Sun, Jan 29, 2017= at 10:40 PM, Richard Guy Briggs <= rgb= @redhat.com> wrote:
On 2017-01-28 13:16, Damian Tyka=C5=82owski wrote:<= br class=3D"gmail_msg"> > Hi

Hi Damian,

> I'm struggling to get proper auditing of usage of power commands, = here's
> what I've got in rules
>
> [root@host01 ~]# cat /etc/audit/audit.rules | grep power
> -w /sbin/shutdown -p rwx -k power
> -w /sbin/poweroff -p rwx -k power
> -w /sbin/reboot -p rwx -k power
> -w /sbin/halt -p rwx -k power
> -w shutdown -p rwx -k power
> -w poweroff -p rwx -k power
> -w reboot -p rwx -k power
> -w halt -p rwx -k power
>
> However despite full host reboot/refreshing rules I'm not getting = events
> with proper key "power"
>
> [root@host01 ~]# cat /var/log/audit/audit.log | grep power
> <empty>
>
> Events are logged though but without key
>
> type=3DUSER_CMD msg=3Daudit(1485604576.755:679): pid=3D3490 uid=3D5004= auid=3D5004
> ses=3D1 subj=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > msg=3D'cwd=3D"/home/user01" cmd=3D"reboot" ter= minal=3Dpts/0 res=3Dsuccess'
>
> type=3DUSER_CMD msg=3Daudit(1485604729.923:658): pid=3D3428 uid=3D5004= auid=3D5004
> ses=3D1 subj=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > msg=3D'cwd=3D"/home/user01" cmd=3D"reboot" ter= minal=3Dpts/0 res=3Dsuccess'
>
> Any idea what is wrong? Rules with other keys seems to work.
I suspect you have another rule that is catching it first?

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailma= n/listinfo/linux-audit