laurel2audit(8)

📦
version 0.8.2 · 4 versions
, in ubuntu stonking

💖 LAUREL2AUDIT 💖

okay so bestie, welcome to laurel2audit(8) — a System Administration Utilities moment, she lives in section 8, and she is literally here to do one job and do it gorgeously 💅

✨ NAME ✨

laurel2audit(8) — transform Laurel logs to back to original Linux Audit format

(yes, the "to back to" is in the original name and no, we are not touching it, she said what she said 🫶)

🌸 SYNOPSIS 🌸

This is a simple filter, okay, simple, she's not doing the most. She reads logs written by laurel(8) and outputs Linux Audit logs that the audit tools and laurel itself should be able to digest. That's it. That's the whole gig. And she eats every single time 🔥

🎀 NOTES 🎀

  • “Enriched” (i.e. ALL_CAPS) keys in audit records are discarded. Gone. Not invited. 🙈
  • EXECVE records are output on one, possibly very long, line. Like, one line. Do not come for her about the length, that's just how it is.
  • If laurel has transformed EXECVE argument lists to single strings (ARGV_STR), that transformation may have been lossy: There is no way to discern space characters as gaps between arguments from space characters as part of individual arguments. 💀 Like, the spaces are all just… spaces. She can't tell them apart. It's giving ambiguous fr fr.
  • An end-of-event (EOE) marker is output for every event. This marker is not part of the original audit.log file, but it has originally been transmitted by the kernel and is passed by auditd(8) to plugins. so it's not new-new, it's vintage, it's restocked 👑

🦋 BUGS 🦋

  • URL-encoded single bytes within strings are not yet handled. not yet, bestie. patience. 🙈
  • Possibly more.

(okay the "possibly more" is doing a LOT of heavy lifting there and honestly? iconic. she's honest. she's humble. she said "Possibly more." and moved on 🫶)

heads up: those are the bugs as stated. nothing hidden, nothing extra, don't shoot the messenger, I'm just the group chat 💖

🌈 SEE ALSO 🌈

the whole audit gang pulled up, no cap, it's a full squad 🧚

👑 AUTHORS 👑

  • Hilko Bengen <bengen@hilluzination.de>

and that's the page, bestie ✨ she's laurel version 0.8.2, she's laurel2audit(8), and she understood the assignment. go read your audit logs. slay. 💖🎀🦋

📦 where this page comes from