Hello,

I'm trying to establish RHEL auditing with auditd.
We would like to log only commands of users connected over ssh and executed as root user. For start I'm testing rules:
-a always,exit -F arch=b64 -S execve -F auid>1000 -F auid<99000000 -F uid=0 -F key=root-commands
-a always,exit -F arch=b32 -S execve -F auid>1000 -F auid<99000000 -F uid=0 -F key=root-commands
It all works well, but the problem is that on some servers there was lot of unnecessary logging of events from system activity type=SYSCALL with tty=(none)
I was trying to add filter with tty!=(none), but tty filter is not supported. Is there some other general option to filter out such events? I don't like idea to write custom filter for every server.

Thanks and best regards,

Luka

Hi,

If someone has similar problem I figured out how to filter those events with tty=(none). For log analyzing we are using ELK stack so I installed Auditbeat on RHEL servers.
Auditbeat supports filtering off tty field
processors:
- drop_event:
when:
contains:
auditd.data.tty: "(none)"

Best regards,

Luka

1 members found this post helpful.