About cgkades

cgkades · ‎09-28-2012

It looks like it's a hex string that is just ascii data. I was able to convert the data manually in python. Can anyone point me in the direction of the docs that cover how to run a script against a certain field? I only want it to translate the field "data=" from hex to ascii when the type=TTY

cgkades · ‎09-28-2012

I would like to translate the data=[hex string]. the entry in splunk: type=TTY msg=audit(1234123.123:6644): tty pid=12345 uid=0 auid=1234 major=137 minor=20 comm="bash" data=121212F0D00DDD0121212423400D host=myhostname | sourcetype=linux_audit | source=/var/log/audit/audit.log all numbers except uid=0 were replaced with random numbers, as well as the host name.

cgkades · ‎09-28-2012

I'm sending my splunk server /var/log/audit.log data from each client machine (splunkforwarder). I have logging of TTY data for root enabled, and would like to be able to read that in splunk. Does anyone know a way to convert the raw data into something readable?

cgkades · ‎07-02-2012

Is there any way to have it auto look up the userid to username without having to manually create a table?

cgkades · ‎06-29-2012

No one knew the answer to this?! I have similar issues with security compliance. I wish they could just do a tail -f on the log

Posts	5
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎06-29-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Convert audit.log TTY data

Re: Convert audit.log TTY data

Re: Convert audit.log TTY data

Convert audit.log TTY data

Re: Can't get lookups to work

Re: How can I make a PCI audit.rules generates few...