Issues with format of Logs generated by Auditd

Question

I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs:

 type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 auid=513 ses=185589 msg='op=deleting user entries id=532 exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/1 res=success'

My auditor wants that hostname and addr to be captured in logs when such administrative activity is performed. Also the date/timestamp is not in good format. Please suggest.

I am pasting my auditd.conf file

---

auditd.conf

#
# This file controls the configuration of the audit daemon
#

log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = none
##name = mydomain
max_log_file = 5
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
##tcp_listen_port =
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key

Answer 1

Here is a quick fix for your datetime format conversion http://www.linuxquestions.org/questions/linux-software-2/how-can-i-read-the-audit-time-stamp-msg%3Daudit-1213186256-105-20663-a-648547

As to your lack of hostname that is a factor of using the name argument as you are (defaults to none if not properly configured) - see http://man7.org/linux/man-pages/man5/auditd.conf.5.html Replace that with name_format=hostname and that issue should disappear.

Answer 2

Another possible solution could be to forward the auditd logs to the standard syslog logger. To do so you can configure the audispd syslog plugin. In a debian machine should be under /etc/audispd/plugins.d/syslog

root@debian:/etc# cat /etc/audisp/plugins.d/syslog.conf 
# This file controls the configuration of the
# syslog plugin. It simply takes events and writes
# them to syslog.

active = yes
direction = out
path = builtin_syslog
type = builtin 
args = LOG_INFO
format = string

Answer 3

A possibly more complete answer:

The hostname and addr values in these audit messages are set when the various shadow-utils packages (including userdel) calls the libaudit audit_log_user_message() or audit_log_acct_message() routines.

From the source (shadow-4.1.4.2) it would appear that the shadow-util's login utility is the only one that sets hostname (and tty). All the other utilities (including userdel) set hostname, addr and tty to NULL.

For information, the libaudit routines will attempt to resolve the host's address (addr) if a hostname is given with no address, and also attempt to resolve the associated terminal (tty). We can see that the terminal resolution is successful.

As has been suggested, if you set name_format in /etc/audit/auditd.conf to either 'hostname' or 'fqdn' then a node parameter will appear in all auditd logs. Thus, say your fully qualified domain name is 'hosta.subdom.maindom', and you set name_format = 'fqdn' then when the above audit message occurs you would see

node=hosta.subdom.maindom type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 auid=513 ses=185589 msg='op=deleting user entries id=532 exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/1 res=success'

and from this you have the fqdn this log was recorded on and you can extrapolate it's addr.