linux audit (9)--生成audit报表

aureport这个命令可以生成一个总结性的柱状图报表，默认情况下，在/var/log/audit目录下的所有日志文件都会生成一个报表，也可以使用如下命令来指定一个不同的文件，aureport options -if file_name。

1、按照时间来生成报告：

~]# aureport --start // :: --end // ::

2、To generate a report of all executable file events, use the following command:

~]# aureport -x

结果如下所示：

:~ # aureport -x

Executable Report
====================================
# date time exe term host auid event
====================================
. // :: /usr/lib/systemd/systemd ? ? -
. // :: /usr/sbin/crond cron ? -
. // :: /usr/sbin/crond cron ? -
. // :: /usr/sbin/crond cron ?
. // :: /usr/sbin/crond cron ?
. // :: /usr/sbin/crond cron ?
. // :: /usr/sbin/crond cron ?
. // :: /usr/sbin/crond cron ? -
. // :: /usr/sbin/crond cron ? -
. // :: /usr/sbin/crond cron ?
. // :: /usr/sbin/crond cron ?
. // :: /usr/sbin/crond cron ?
. // :: /usr/sbin/crond cron ?
. // :: /usr/sbin/crond cron ? -
. // :: /usr/sbin/crond cron ? -
. // :: /usr/sbin/crond cron ?  

3、To generate a summary of the executable file event report above, use the following command:

~]# aureport -x --summary

4、To generate a summary report of failed events for all users, use the following command:

~]# aureport -u --failed --summary -i

5、To generate a summary report of all failed login attempts per each system user, use the following command:

~]# aureport --login --summary -i

6、To generate a report from an ausearch query that searches all file access events for user ID 1000, use the following command:

~]# ausearch --start today --loginuid  --raw | aureport -f --summary

7、To generate a report of all Audit files that are queried and the time range of events they include, use the following command:

~]# aureport -t

For a full listing of all aureport options, see the aureport(8) man page.