From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Audit format utility Date: Tue, 23 Sep 2014 18:03:48 -0400 Message-ID: <7024971.pEsk4Tjhkf@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from x2.localnet (vpn-52-72.rdu2.redhat.com [10.10.52.72]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s8NM3gqV020047 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 23 Sep 2014 18:03:43 -0400 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux-audit List-Id: linux-audit@redhat.com Hello, I have been doing some thinking about allowing user defined formats to be declared as a parameter to ausearch. Before I commit to that, I thought it might be interesting to create a "mockup". I have placed a utility here: http://people.redhat.com/sgrubb/files/auformat.tar.gz Just untar it and run make. $ ./auformat Usage: auformat [path-to-log] --fill What this means is that you can give it a path to a file. If you don't do that, it will read from stdin. Then it will output the fields that you specify. To specify fields start with a % and then put the name as seen in logs. A couple examples: %auid %pid %path %exe This will dump the raw value. But suppose you wanted the interpreted values? Tell it to interpret by giving uppercase: %AUID %SYSCALL %RES %PATH Not all events have all fields. By default it will emit a message to stderr about this. But, you can give it --fill which will print "(none)" in that case. So, a use might be: # ausearch --start today -m login --raw | ~sgrubb/test/auformat/auformat "%time %AUID %ses %RES\n" The app also has 4 virtual field names: date, time, milli, serial. These relate to the event timestamp which you couldn't specify any other way. In any event, I am putting this out to see what people think. -Steve