topic Re: Convert audit.log TTY data in Splunk Search

Convert audit.log TTY data

cgkades — Fri, 28 Sep 2012 14:24:13 GMT

I'm sending my splunk server /var/log/audit.log data from each client machine (splunkforwarder). I have logging of TTY data for root enabled, and would like to be able to read that in splunk. Does anyone know a way to convert the raw data into something readable?

Re: Convert audit.log TTY data

jsb22 — Fri, 28 Sep 2012 16:33:46 GMT

Can you provide an example of what you see and what you want to see? Are you looking for something like this where you would convert the data within a field? Or are you not getting fields, and wnat to extract them into a fields?

Re: Convert audit.log TTY data

cgkades — Fri, 28 Sep 2012 18:10:29 GMT

I would like to translate the data=[hex string].
the entry in splunk:

type=TTY msg=audit(1234123.123:6644): tty pid=12345 uid=0 auid=1234 major=137 minor=20 comm="bash" data=121212F0D00DDD0121212423400D host=myhostname | sourcetype=linux_audit | source=/var/log/audit/audit.log

all numbers except uid=0 were replaced with random numbers, as well as the host name.

Re: Convert audit.log TTY data

cgkades — Fri, 28 Sep 2012 18:35:03 GMT

It looks like it's a hex string that is just ascii data. I was able to convert the data manually in python. Can anyone point me in the direction of the docs that cover how to run a script against a certain field? I only want it to translate the field "data=" from hex to ascii when the type=TTY

Re: Convert audit.log TTY data

dharshini — Thu, 24 Jan 2019 07:18:08 GMT

Running into the same issue, can help mention how to tried to extract field "data" into string format.
Thanks.

Re: Convert audit.log TTY data

rafadvega — Wed, 30 Sep 2020 02:57:18 GMT

try this:

Example raw log:
type=USER_TTY msg=audit(1573643958.798:1973): pid=2964 uid=0 auid=1000 ses=22 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data=636174202F7661722F6C6F672F61756469742F61756469742E6C6F67207C206772657020555345525F545459UID="root" AUID="rdevega"

splunk code:

your search here
| eval keystrokes = urldecode(replace(data,"([0-9A-F]{2})","%\1"))
| table data keystrokes

results: