Solved auditreduce arguments -a and -d not working

J

jtocci

I have been trying to get auditreduce arguments -a and -d to work for a few days now and I'm wondering why I can't figure it out.

Code: 
auditreduce -e root /var/audit/20261103* | praudit

produces a bunch of text, all of it calling out
Code: 
Nov  3 17:18:28 2026

But if I try
Code: 
auditreduce -d 20261103
or
Code: 
auditreduce -a 20261103
then I get nothing.

The man page is straightforward:
Code: 
     -a YYYYMMDD[HH[MM[SS]]]
             Select records that occurred after or on the given datetime.
...
     -d YYYYMMDD
             Select records that occurred on a given date.  This option cannot
             be used with -a or -b.

I don't understand my problem. Any hints appreciated.
 
above commands were shortened for clarity. Actual text was

Code: 
auditreduce -a 20261103 /var/audit/20261103* | praudit   /no worky
auditreduce -d 20261103 /var/audit/20261103* | praudit   /no worky
auditreduce /var/audit/20261103* | praudit               /worky
..lots of text...
 
Code: 
auditreduce -a 20251103045800 /var/audit/20261103045800.* | praudit   /no worky
auditreduce /var/audit/20261103045800.* | praudit                     /worky
 
Code: 
auditreduce -u justin.tocci -a 20261103045800 /var/audit/20261103045800.20261103072600.z1459.xxx.com | praudit  /no worky
auditreduce -u justin.tocci /var/audit/20261103045800.20261103072600.z1459.xxx.com | praudit                    /worky

I've tested again without the praudit and auditreduce is just not putting out content on the bad commands.

auditreduce is not a package so I can't reinstall.
I've read the whole manpage again and there just isn't anything there that I could be missing.

Code: 
freebsd-version
15.1-RELEASE-p6

Is this a bug?
 
works for me
-a requires a time spec / date only won't work properly
praudit prints UTC time but you need to pass local time to -a and -d
 
Thank you for your reply covacat!

crazy that it works for you! it doesn't work for me on multiple computers now.
below i tried a full date and time in -a, no joy.
I set -a to midnight so that I would be sure to get everything after about six am today and still no joy.

%sudo auditreduce -a 20261103000000 /var/audit/20261103184147.not_terminated.z1459.xxx.com | praudit -l
%

remove the -a argument and i get a bunch of stuff all labeled around "Tue Nov 3 19:30:06 2026".
 
15.0-RELEASE-p8 computer:

Code: 
nano /etc/security/audit_control
dir:/var/audit
dist:off
flags:lo,aa,ex
minfree:5
naflags:lo,aa
policy:cnt,argv
filesz:2M
expire-after:10M
host:ipfw.xxx.com

Code: 
%auditreduce -a 20261103000000 /var/audit/20261103194951.not_terminated.ipfw.xxx.com | praudit -l
no lines
%auditreduce /var/audit/* | praudit -l
header,56,11,audit startup,0,Tue Nov  3 19:47:46 2026, + 246 msec,text,auditd::Audit startup,return,success,0,trailer,56,
header,57,11,audit shutdown,0,Tue Nov  3 19:49:51 2026, + 932 msec,text,auditd::Audit shutdown,return,success,0,trailer,57,
header_ex,76,11,audit startup,0,2600:1702:7489:a81f:1,Tue Nov  3 19:49:51 2026, + 939 msec,text,auditd::Audit startup,return,success,0,trailer,76,
header_ex,76,11,audit startup,0,2600:1702:7489:a81f::1,Tue Nov  3 19:49:51 2026, + 939 msec,text,auditd::Audit startup,return,success,0,trailer,76,
 
On the 15.0-RELEASE-p8 computer i wasn't getting terminal command logs. i had to log out and re-ssh back in, then i got my commands in the logs. But i tested again and everything is the same. attempting to use the -a argument causes no logs to be found.
 
15.1-RELEASE-p6
Code: 
% locale
LANG=
LC_CTYPE="C"
LC_COLLATE="C"
LC_TIME="C"
LC_NUMERIC="C"
LC_MONETARY="C"
LC_MESSAGES="C"
LC_ALL=

15.0-RELEASE-p8
Code: 
% locale
LANG=C.UTF-8
LC_CTYPE="C.UTF-8"
LC_COLLATE="C.UTF-8"
LC_TIME="C.UTF-8"
LC_NUMERIC="C.UTF-8"
LC_MONETARY="C.UTF-8"
LC_MESSAGES="C.UTF-8"
LC_ALL=
 
go to /usr/src/contrib/openbsm/bin/auditreduce
edit auditreduce.c
search for /* fprintf(stderr, "Time converted = %s\n", timestr); */ and uncomment it
it should be one under case 'a' and one under case 'd' (and some others but let them be)
then go to /usr/src/usr.sbin/auditreduce
make obj depend all
the binary should be in
/usr/obj/usr/src/amd64.amd64/usr.sbin/auditreduce/auditreduce
use
/usr/obj/usr/src/amd64.amd64/usr.sbin/auditreduce/auditreduce -a TIMESPEC ...
look for Time converted and see if it is legit
 
Unexpected!
setting locale to en_US.UTF-8 caused a couple of the audit lines to come through a -a argument.
that audit file was different. it has the name
Code: 
auditreduce -a 20261103000000 /var/audit/20261103194746.20261103194951  | praudit -l

Right after starting auditd I added the host name to /etc/security/audit_control. You can see how the working file doesn't have a host name on the end of the filename.

Perhaps it doesn't like the host name setting? I added it so i could put multiple hosts into one folder eventually but I can do that different.

OK!!! That fixed the 15.0-RELEASE-p8 computer
I changed the locale to C using
Code: 
env LANG=C locale
, restarted auditd, logged out, logged in and it still works.

And did the same thing to my 15.1 computer > locale to C, restarted auditd, logged out, logged in and that works now too.
Thank you covacat I really appreciate it.

But what did you want me to do with the source? there is no reference to host in the autoreduce.c file. Maybe i missed an error?

The only reason i put the host attribute in there is because i got this when i first began setup(seems like a foot gun to me now):
Code: 
% sudo auditd -d
auditd 96593 - - starting...
auditd 96593 - - Auditing disabled
auditd 96593 - - Configured trail files distribution.
auditd 96593 - - Auditing enabled
auditd 96593 - - New audit file is /var/audit/20261103210107.not_terminated
auditd 96593 - - Registered 677 event to class mappings.
auditd 96593 - - Registered non-attributable event mask.
auditd 96593 - - Set audit policy in kernel.
auditd 96593 - - Set audit trail size in kernel.
auditd 96593 - - Set audit trail queue in kernel.
auditd 96593 - - Set audit trail min free percent in kernel.
>>auditd 96593 - - audit_control(5) may be missing 'host:' field
auditd 96593 - - Audit controls init successful

Adding the host parameter made the error go away and it looked normal:
Code: 
sudo auditd -d
auditd 96639 - - starting...
auditd 96639 - - Auditing enabled
auditd 96639 - - Configured trail files distribution.
auditd 96639 - - renamed /var/audit/20261103210107.not_terminated to /var/audit/20261103210107.20261103210233
auditd 96639 - - New audit file is /var/audit/20261103210233.not_terminated.ipfw.wfprod.com
auditd 96639 - - Registered 677 event to class mappings.
auditd 96639 - - Registered non-attributable event mask.
auditd 96639 - - Set audit policy in kernel.
auditd 96639 - - Set audit trail size in kernel.
auditd 96639 - - Set audit trail queue in kernel.
auditd 96639 - - Set audit trail min free percent in kernel.
auditd 96639 - - Set audit host address information in kernel.
auditd 96639 - - Audit controls init successful
 
covacat said:
go to /usr/src/contrib/openbsm/bin/auditreduce
edit auditreduce.c
search for /* fprintf(stderr, "Time converted = %s\n", timestr); */ and uncomment it
it should be one under case 'a' and one under case 'd' (and some others but let them be)
then go to /usr/src/usr.sbin/auditreduce
make obj depend all
the binary should be in
/usr/obj/usr/src/amd64.amd64/usr.sbin/auditreduce/auditreduce
use
/usr/obj/usr/src/amd64.amd64/usr.sbin/auditreduce/auditreduce -a TIMESPEC ...
look for Time converted and see if it is legit
Click to expand...
oh nice! I am no C expert but I think I could do that. Thank you!
covacat said:
cool that it works. i don't have a hostname in that file though
Click to expand...
which file? audit_control or the output of auditd -d?
 
audit_control. all the settings are stock. i just launched it with "onestart" did some login / sudo / and then "onestop". then tried the auditreduce
 
that explains why you succeeded and i failed then. I got that host warning and broke everything before testing.
 
You must log in or register to reply here.
Back
Top