Using the scripts mkbar and mkgraph you can illustrate your audit statistics with various graphs and charts. As with any other aureport command, the plotting commands are scriptable and can easily be configured to run as cron jobs.
mkbar and mkgraph were created by Steve Grubb at Red Hat. They are available from http://people.redhat.com/sgrubb/audit/visualize/. Because the current version of audit in openSUSE does not ship with these scripts, proceed as follows to make them available on your system:
Download the scripts to root
's ~/bin
directory:
wget http://people.redhat.com/sgrubb/audit/visualize/mkbar -O ~/bin/mkbar wget http://people.redhat.com/sgrubb/audit/visualize/mkgraph -O ~/bin/mkgraph
Adjust the file permissions to read, write, and execute for root
:
chmod 744 ~/bin/mk{bar,graph}
To plot summary reports, such as the ones discussed in Section 30.5, “Configuring Audit Reports”, use the script mkbar. Some example commands could look like the following:
aureport -e -i --summary | mkbar events
aureport -f -i --summary | mkbar files
aureport -l -i --summary | mkbar login
aureport -u -i --summary | mkbar users
aureport -s -i --summary | mkbar syscalls
To create a summary chart of failed events of any of the above event
types, just add the --failed
option to the respective
aureport command. To cover a certain period of time
only, use the -ts
and -te
options on
aureport. Any of these commands can be tweaked further by narrowing down
its scope using grep or egrep and regular expressions. See the comments
in the mkbar script for an example. Any of the above
commands produces a PNG file containing a bar chart of the requested
data.
To illustrate the relationship between different kinds of audit objects, such as users and system calls, use the script mkgraph. Some example commands could look like the following:
LC_ALL=C aureport -u -i | awk '/^[0-9]/ { print $4" "$7 }' | sort | uniq | mkgraph users_vs_exec
LC_ALL=C aureport -f -i | awk '/^[0-9]/ { print $8" "$4 }' | sort | uniq | mkgraph users_vs_files
LC_ALL=C aureport -s -i | awk '/^[0-9]/ { print $4" "$6 }' | sort | uniq | mkgraph syscall_vs_com
LC_ALL=C aureport -s -i | awk '/^[0-9]/ { print $5" "$4 }' | sort | uniq | mkgraph | syscall_vs_file
Graphs can also be combined to illustrate complex relationships. See the
comments in the mkgraph script for further information
and an example. The graphs produced by this script are created in
PostScript format by default, but you can change the output format by
changing the EXT
variable in the script from
ps
to png
or
jpg
. To cover a certain period of time only, use the
-ts
and -te
options on aureport.