Splunk Search
Highlighted

Convert audit.log TTY data

Explorer

I'm sending my splunk server /var/log/audit.log data from each client machine (splunkforwarder). I have logging of TTY data for root enabled, and would like to be able to read that in splunk. Does anyone know a way to convert the raw data into something readable?

Tags (1)
Highlighted

Re: Convert audit.log TTY data

Path Finder

Can you provide an example of what you see and what you want to see? Are you looking for something like this where you would convert the data within a field? Or are you not getting fields, and wnat to extract them into a fields?

0 Karma
Highlighted

Re: Convert audit.log TTY data

Explorer

I would like to translate the data=[hex string].
the entry in splunk:

type=TTY msg=audit(1234123.123:6644): tty pid=12345 uid=0 auid=1234 major=137 minor=20 comm="bash" data=121212F0D00DDD0121212423400D host=myhostname | sourcetype=linux_audit | source=/var/log/audit/audit.log

all numbers except uid=0 were replaced with random numbers, as well as the host name.

0 Karma
Highlighted

Re: Convert audit.log TTY data

Explorer

It looks like it's a hex string that is just ascii data. I was able to convert the data manually in python. Can anyone point me in the direction of the docs that cover how to run a script against a certain field? I only want it to translate the field "data=" from hex to ascii when the type=TTY

0 Karma
Highlighted

Re: Convert audit.log TTY data

Explorer

Running into the same issue, can help mention how to tried to extract field "data" into string format.
Thanks.

0 Karma
Highlighted

Re: Convert audit.log TTY data

Explorer

try this:

Example raw log:
type=USERTTY msg=audit(1573643958.798:1973): pid=2964 uid=0 auid=1000 ses=22 subj=unconfinedu:unconfinedr:unconfinedt:s0-s0:c0.c1023 data=636174202F7661722F6C6F672F61756469742F61756469742E6C6F67207C206772657020555345525F545459UID="root" AUID="rdevega"

splunk code:

your search here
| eval keystrokes = urldecode(replace(data,"([0-9A-F]{2})","%\1"))
| table data keystrokes

results:

alt text

0 Karma