* last restart of auditd - in EPOCH time @ 2021-08-04 19:25 warron.french 2021-08-04 20:02 ` Steve Grubb 0 siblings, 1 reply; 3+ messages in thread From: warron.french @ 2021-08-04 19:25 UTC (permalink / raw) To: Linux Audit [-- Attachment #1.1: Type: text/plain, Size: 660 bytes --] Is there a hidden switch option to auditctl that would tell me the last time auditd was restart specifically in epoch (down to the second)? If my rules are changed to non-immutable ( -e 1 ) rebooted, and then changed back to immutable ( -e 2 ), then I discover this weeks later, then I will not know for sure which was most recently updated/restarted. That is the reason for the question. I am doing this for a hardening script that will tell me based on known recent changes (as of script execution), but I cannot properly/successfully assess for dates outside of a day or so. :-/ Any ideas would be appreciated, -------------------------- Warron French [-- Attachment #1.2: Type: text/html, Size: 993 bytes --] [-- Attachment #2: Type: text/plain, Size: 106 bytes --] -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: last restart of auditd - in EPOCH time 2021-08-04 19:25 last restart of auditd - in EPOCH time warron.french @ 2021-08-04 20:02 ` Steve Grubb 2021-08-05 13:03 ` warron.french 0 siblings, 1 reply; 3+ messages in thread From: Steve Grubb @ 2021-08-04 20:02 UTC (permalink / raw) To: Linux Audit Hello, On Wednesday, August 4, 2021 3:25:40 PM EDT warron.french wrote: > Is there a hidden switch option to auditctl that would tell me the last > time auditd was restart specifically in epoch (down to the second)? Not auditctl, but maybe ausearch: ausearch --start boot -m daemon_start -i Or... systemctl status auditd.service | grep Active And if you need this in the epoch: date --date="$(systemctl status auditd.service|grep Active|awk '{printf "%s %s", $6, $7}')" +"%s" > If my rules are changed to non-immutable ( -e 1 ) rebooted, and then > changed back to immutable ( -e 2 ), then I discover this weeks later, then > I will not know for sure which was most recently updated/restarted. That might be one issue with using ausearch...it might have scrolled away. Maybe this could be collected at start and printed as part of the auditd state report? I could see this being useful information for various reasons. > That is the reason for the question. I am doing this for a hardening > script that will tell me based on known recent changes (as of script > execution), but I cannot properly/successfully assess for dates outside of > a day or so. :-/ systemctl should be able to get you the info you need. I might add this info to the state report, though. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: last restart of auditd - in EPOCH time 2021-08-04 20:02 ` Steve Grubb @ 2021-08-05 13:03 ` warron.french 0 siblings, 0 replies; 3+ messages in thread From: warron.french @ 2021-08-05 13:03 UTC (permalink / raw) To: Steve Grubb; +Cc: Linux Audit [-- Attachment #1.1: Type: text/plain, Size: 2286 bytes --] Thanks for the info. While driving home I realized that I had not considered using systemctl and assessing the "Active:" field like you suggested here. Then before reading your email I tried my own way, doing: date +%s -d "$(systemctl status auditd | egrep Active | egrep -o "[[:digit:]]{4}-[[:digit:]]{2}--[[:digit:]]{2}\s*[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}")" What is interesting is that I would expect both commands to render the same result, but for some reason your command reports today's date and time, whereas mine renders the valid date and time (from last week, which I know to be true). When I say your command, I mean this one: date --date="$(systemctl status auditd.service|grep Active|awk '{printf "%s %s", $6, $7}')" +"%s" AH! I figured it out, I was missing the letter 'f' on printf. -------------------------- Warron French On Wed, Aug 4, 2021 at 4:03 PM Steve Grubb <sgrubb@redhat.com> wrote: > Hello, > > On Wednesday, August 4, 2021 3:25:40 PM EDT warron.french wrote: > > Is there a hidden switch option to auditctl that would tell me the last > > time auditd was restart specifically in epoch (down to the second)? > > Not auditctl, but maybe ausearch: > ausearch --start boot -m daemon_start -i > > Or... > systemctl status auditd.service | grep Active > > And if you need this in the epoch: > date --date="$(systemctl status auditd.service|grep Active|awk '{printf > "%s > %s", $6, $7}')" +"%s" > > > If my rules are changed to non-immutable ( -e 1 ) rebooted, and then > > changed back to immutable ( -e 2 ), then I discover this weeks later, > then > > I will not know for sure which was most recently updated/restarted. > > That might be one issue with using ausearch...it might have scrolled away. > Maybe this could be collected at start and printed as part of the auditd > state report? I could see this being useful information for various > reasons. > > > That is the reason for the question. I am doing this for a hardening > > script that will tell me based on known recent changes (as of script > > execution), but I cannot properly/successfully assess for dates outside > of > > a day or so. :-/ > > systemctl should be able to get you the info you need. I might add this > info > to the state report, though. > > -Steve > > > [-- Attachment #1.2: Type: text/html, Size: 3226 bytes --] [-- Attachment #2: Type: text/plain, Size: 106 bytes --] -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-08-05 13:03 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-08-04 19:25 last restart of auditd - in EPOCH time warron.french 2021-08-04 20:02 ` Steve Grubb 2021-08-05 13:03 ` warron.french
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).