Splunk Search

Convert audit.log TTY data

cgkades
Explorer

I'm sending my splunk server /var/log/audit.log data from each client machine (splunkforwarder). I have logging of TTY data for root enabled, and would like to be able to read that in splunk. Does anyone know a way to convert the raw data into something readable?

Tags (1)

rafadvega
Path Finder

try this:

Example raw log:
type=USER_TTY msg=audit(1573643958.798:1973): pid=2964 uid=0 auid=1000 ses=22 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data=636174202F7661722F6C6F672F61756469742F61756469742E6C6F67207C206772657020555345525F545459UID="root" AUID="rdevega"

splunk code:

your search here
| eval keystrokes = urldecode(replace(data,"([0-9A-F]{2})","%\1"))
| table data keystrokes

results:

alt text

0 Karma

cgkades
Explorer

It looks like it's a hex string that is just ascii data. I was able to convert the data manually in python. Can anyone point me in the direction of the docs that cover how to run a script against a certain field? I only want it to translate the field "data=" from hex to ascii when the type=TTY

0 Karma

dharshini
Explorer

Running into the same issue, can help mention how to tried to extract field "data" into string format.
Thanks.

0 Karma

jsb22
Path Finder

Can you provide an example of what you see and what you want to see? Are you looking for something like this where you would convert the data within a field? Or are you not getting fields, and wnat to extract them into a fields?

0 Karma

cgkades
Explorer

I would like to translate the data=[hex string].
the entry in splunk:

type=TTY msg=audit(1234123.123:6644): tty pid=12345 uid=0 auid=1234 major=137 minor=20 comm="bash" data=121212F0D00DDD0121212423400D host=myhostname | sourcetype=linux_audit | source=/var/log/audit/audit.log

all numbers except uid=0 were replaced with random numbers, as well as the host name.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...