Skip to content

Instantly share code, notes, and snippets.

@artbikes

artbikes/gist:2313040

Created April 5, 2012 18:23
Show Gist options
  • Star 16 You must be signed in to star a gist
  • Fork 5 You must be signed in to fork a gist
  • Save artbikes/2313040 to your computer and use it in GitHub Desktop.
Save artbikes/2313040 to your computer and use it in GitHub Desktop.
Download ZIP
auditd logstash pattern
Raw
gistfile1.sh
AUDIT type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): user pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} auid=%{NUMBER:audit_audid} subj=%{WORD:audit_subject} msg=%{GREEDYDATA:audit_message}
AUDITLOGIN type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): login pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} old auid=%{NUMBER:old_auid} new auid=%{NUMBER:new_auid} old ses=%{NUMBER:old_ses} new ses=%{NUMBER:new_ses}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment