Skip to content

Instantly share code, notes, and snippets.

@imweijh

imweijh/gist:9f53b1fa8fc640129c31fe0233682550

Forked from artbikes/gist:2313040
Created May 5, 2017 06:59
Show Gist options
  • Save imweijh/9f53b1fa8fc640129c31fe0233682550 to your computer and use it in GitHub Desktop.
Save imweijh/9f53b1fa8fc640129c31fe0233682550 to your computer and use it in GitHub Desktop.
Download ZIP
auditd logstash pattern
Raw
gistfile1.sh
AUDIT type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): user pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} auid=%{NUMBER:audit_audid} subj=%{WORD:audit_subject} msg=%{GREEDYDATA:audit_message}
AUDITLOGIN type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): login pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} old auid=%{NUMBER:old_auid} new auid=%{NUMBER:new_auid} old ses=%{NUMBER:old_ses} new ses=%{NUMBER:new_ses}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment