auditd

Documentation

Overview

Package auditd provides functionality for extracting audit information from the Linux kernel's built-in auditing functionality.

Index

• Constants
• func SetLogger(l *zap.SugaredLogger)
• type Auditd
  • func (o *Auditd) Read(ctx context.Context) error

Constants

const (
	// AuditdProcessorComponentName is the name of the component
	// that reads from auditd. This is used in the health check.
	AuditdProcessorComponentName = "auditd-processor"
)

Functions

func SetLogger

func SetLogger(l *zap.SugaredLogger)

Types

type Auditd

type Auditd struct {
	// After filters audit events prior to a particular point in time.
	// For example, using time.Now means all events that occurred
	// before time.Now will be ignored.
	//
	// A zero time.Time means no events are ignored.
	After time.Time

	// Audits receives audit log lines from one or more audit files.
	Audits <-chan string

	// Logins receives common.RemoteUserLogin when a user logs in
	// remotely through a service like sshd.
	Logins <-chan common.RemoteUserLogin

	// EventW is the auditevent.EventWriter to write events to.
	EventW *auditevent.EventWriter

	Health *health.Health
}

Auditd enables correlation of remote user logins (and the credential they used to log in with, such as a SSH certificate) and Linux audit events.

func (*Auditd) Read

func (o *Auditd) Read(ctx context.Context) error

Read reads Linux audit messages from Auditd.Logins, parsing them into Linux audit messages. It correlates the Linux audit events and their session IDs with remote user logins sourced from Auditd.Logins.