diff --git a/pages/linux/aureport.md b/pages/linux/aureport.md new file mode 100644 index 00000000000000..f6645b7ab40853 --- /dev/null +++ b/pages/linux/aureport.md @@ -0,0 +1,32 @@ +# aureport + +> Generate summary reports of auditd logs. +> More information: . + +- Display a summary of auditd events: + +`sudo aureport` + +- Generate a summary of login events: + +`sudo aureport {{[-l|--login]}}` + +- List all syscall reports: + +`sudo aureport {{[-s|--syscall]}}` + +- Generate a summary of executable events: + +`sudo aureport {{[-x|--executable]}}` + +- Show a summary of events for a specific time range: + +`sudo aureport {{[-ts|--start]}} {{start_time}} {{[-te|--end]}} {{end_time}}` + +- List all audit files and the time range of events they cover: + +`sudo aureport {{[-t|--log-time]}}` + +- Display help: + +`aureport --help`