Deployment Architecture

How to convert audit.log data to usernames instead of user id numbers?

splukUP
Engager

I'm using the standard auditd in Linux to capture "permission denied" messages. For some odd reason, auditd likes to store usernames as numbers (eg uid=500 instead of uid=john). It is possible to read audit.log by calling ausearch ... -i which will do the number->name conversion. Is there an easy, painless way to get the converted data in to splunk?

Tags (1)

jsb22
Path Finder

For those who were still looking for answers after viewing this thread, chech out this link

0 Karma

Lowell
Super Champion

You should check out the rlog.sh scripted input provided by the unix app that is shipped with splunk. It will convert ids to names and format timestamps for you. It uses the ausearch command line tool behind the scenes to give you a more human readable format.

Unfortunately, the default readlog.py script (which is used by rlog.sh) contains some silly mistakes that can cause your log to be reprocessed. I'd recommend that you apply the fix that I've come up with, which can be found on this question:

http://answers.splunk.com/questions/5650/nix-possible-bug-in-rlog-sh-script/5725#5725

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.