ausearch

Search for SELinux AVC denials

$ sudo ausearch -m avc

$ sudo ausearch -c httpd

$ sudo ausearch -ui 1000

$ sudo ausearch -ts recent

$ sudo ausearch -m user_login -sv no

$ sudo ausearch -f path/to/file

$ sudo ausearch -m avc --raw

ausearch [OPTIONS]

ausearch queries the Linux audit log for events. It can search by message type, user, process, file, time range, and other criteria, making it essential for security analysis and incident investigation.

-m, --message type

Search for specific message types (avc, user_login, etc.)

Search by command/executable name

Search by user ID

Search for events related to a specific file

Start time for search (recent, today, or timestamp)

End time for search

Filter by success or failure

Output in raw format for further processing

Interpret numeric values (UIDs, syscalls, etc.)

/etc/audit/auditd.conf

Main audit daemon configuration, controls log file location and retention policy.

Defines which events are logged by the audit system. Determines what events are searchable.

Requires root privileges to access audit logs. The audit daemon must be running and logging events. Large audit logs may slow searches; use time filters to narrow results.

ausearch is part of the audit package, providing search capabilities for the Linux Audit Framework.

aureport(8), auditctl(8), audit2why(1)