I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs:
type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 auid=513 ses=185589 msg='op=deleting user entries id=532 exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/1 res=success'
My auditor wants that hostname and addr to be captured in logs when such administrative activity is performed. Also the date/timestamp is not in good format. Please suggest.
I am pasting my auditd.conf file
# # This file controls the configuration of the audit daemon # log_file = /var/log/audit/audit.log log_format = RAW log_group = root priority_boost = 4 flush = INCREMENTAL freq = 20 num_logs = 4 disp_qos = lossy dispatcher = /sbin/audispd name_format = none ##name = mydomain max_log_file = 5 max_log_file_action = ROTATE space_left = 75 space_left_action = SYSLOG action_mail_acct = root admin_space_left = 50 admin_space_left_action = SUSPEND disk_full_action = SUSPEND disk_error_action = SUSPEND ##tcp_listen_port = tcp_listen_queue = 5 tcp_max_per_addr = 1 ##tcp_client_ports = 1024-65535 tcp_client_max_idle = 0 enable_krb5 = no krb5_principal = auditd ##krb5_key_file = /etc/audit/audit.key