Linux Audit syscall
Linux Audit syscall. Kernel audit syscall records include identity, architecture, return status and process context.
Source and collection
Typically /var/log/audit/audit.log when auditd is configured; audit transport records can be aggregated differently.
Review audit rules, backlog/lost-event counters, daemon state and retention. Use ausearch with an authorized local log copy.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 2
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 52464230aca002e92ab3e55dd62fd46fe810a62ba97874d8fe00977736c6ee60
type=SYSCALL msg=audit(1485893834.891:18877199): arch=c000003e syscall=44 success=yes exit=184 a0=9 items=0 ppid=1240 pid=1281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="charon" exe=2F7573722F6C6962657865632F7374726F6E677377616E2F636861726F6E202864656C6574656429 key=(null)
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
raw record | audit |
- type
- Audit record type.
- msg=audit(epoch:serial)
- Timestamp and serial used to group records.
- auid / uid
- Login identity and effective process context differ.
- arch
- Syscall architecture discriminator when present.
Investigation uses
- Join the audit timestamp and serial to related EXECVE, CWD and PATH records.
- Preserve the raw record and its complete event group before enrichment or normalization.
Validation boundaries
Syscall numbers depend on architecture; auid 4294967295 represents an unset login UID, not a named user.
This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.