ausearch

Install

# RHEL / Alma / Rocky
sudo dnf install audit

# Debian / Ubuntu
sudo apt install auditd

# openSUSE
sudo zypper install audit

# Arch
sudo pacman -S audit

What it does

ausearch queries the Linux Audit subsystem logs, allowing administrators to filter audit records by event type, user, time range, syscall, SELinux context, and more.

How it works (mechanical)

• Reads audit logs from /var/log/audit/audit.log.
• Filters entries based on supplied criteria.
• Works with the auditd service and kernel audit subsystem.
• Outputs raw or formatted audit event records.

Quick Start

# Show recent SELinux denials
sudo ausearch -m avc -ts recent

10 Practical Examples

# 1) All AVC (SELinux) denials
sudo ausearch -m avc

# 2) Denials from the last hour
sudo ausearch -m avc -ts recent

# 3) Events by user ID
sudo ausearch -ua 1000

# 4) Search by executable
sudo ausearch -x httpd

# 5) Failed login attempts
sudo ausearch -m USER_LOGIN -sv no

# 6) Search by PID
sudo ausearch -p 1234

# 7) Search by syscall
sudo ausearch -sc open

# 8) Events since specific date
sudo ausearch -ts 2026-02-01

# 9) Combine filters
sudo ausearch -m avc -ua 1000

# 10) Pipe to aureport for summary
sudo ausearch -m avc -ts today | aureport -avc

Notes & Gotchas

• Requires auditd service running.
• Most searches require sudo to read audit logs.
• Use -ts and -te for time range filtering.
• Large logs can produce extensive output; filter carefully.

Related Commands

• aureport — summarized audit reports.
• auditctl — manage audit rules.
• semanage — manage SELinux policy.
• getenforce — check SELinux mode.
• journalctl — systemd journal logs.