Deployment Architecture

How to convert audit.log data to usernames instead of user id numbers?


I'm using the standard auditd in Linux to capture "permission denied" messages. For some odd reason, auditd likes to store usernames as numbers (eg uid=500 instead of uid=john). It is possible to read audit.log by calling ausearch ... -i which will do the number->name conversion. Is there an easy, painless way to get the converted data in to splunk?

Tags (1)

Path Finder

For those who were still looking for answers after viewing this thread, chech out this link

0 Karma

Super Champion

You should check out the scripted input provided by the unix app that is shipped with splunk. It will convert ids to names and format timestamps for you. It uses the ausearch command line tool behind the scenes to give you a more human readable format.

Unfortunately, the default script (which is used by contains some silly mistakes that can cause your log to be reprocessed. I'd recommend that you apply the fix that I've come up with, which can be found on this question:

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.