Linux Audit object paths

Source and collection

Typically /var/log/audit/audit.log when auditd is configured; audit transport records can be aggregated differently.

Review audit rules, backlog/lost-event counters, daemon state and retention. Use ausearch with an authorized local log copy.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 41

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 94e86c0f25a12bc05a2b67814b1753f676cc1840103449aac7e25cd88692ed92

type=PATH msg=audit(1481077231.371:479): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL

Structure and field interpretation

type

Audit record type.

msg=audit(epoch:serial)

Timestamp and serial used to group records.

auid / uid

Login identity and effective process context differ.

arch

Syscall architecture discriminator when present.

Investigation uses

• Join item, inode and path to the corresponding syscall and device context.
• Preserve the raw record and its complete event group before enrichment or normalization.

Validation boundaries

A PATH record alone does not prove a file write, successful access or exfiltration.

This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• Linux SSH authentication — auth.log / secure
• Linux sudo audit messages
• Linux Audit syscall
• Linux Audit command arguments
• SELinux AVC denials
• systemd journal — JSON export

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

• ausearch(8) - Linux manual page

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.