Linux Audit command arguments

Source and collection

Typically /var/log/audit/audit.log when auditd is configured; audit transport records can be aggregated differently.

Review audit rules, backlog/lost-event counters, daemon state and retention. Use ausearch with an authorized local log copy.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 11

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: ecff992510a722b0cdcae3fda1efa4cd257d9e4e9fa6144940b4902147c60eb9

type=EXECVE msg=audit(1581371984.206:579393): argc=1 a0=top

Structure and field interpretation

type

Audit record type.

msg=audit(epoch:serial)

Timestamp and serial used to group records.

auid / uid

Login identity and effective process context differ.

arch

Syscall architecture discriminator when present.

Investigation uses

• Reassemble argument records and correlate the same event serial with SYSCALL and PATH.
• Preserve the raw record and its complete event group before enrichment or normalization.

Validation boundaries

Arguments may be hex encoded, split across records or truncated; do not interpret one record as the entire event.

This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• Linux SSH authentication — auth.log / secure
• Linux sudo audit messages
• Linux Audit syscall
• Linux Audit object paths
• SELinux AVC denials
• systemd journal — JSON export

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

• ausearch(8) - Linux manual page

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.