Getting a nice SELinux audit report

aureport can be used to look at SELinux audit reports, options include [today, this-month, this-week ..etc]. And, if you get anything in the avc row, then, you can issue the --avc -i option.

$ aureport --start today

Summary Report
======================
Range of time in logs: 10/12/2007 10:09:05.572 - 10/24/2007 14:20:01.242
Selected time for report: 10/24/2007 00:00:01 - 10/24/2007 14:20:01.242
Number of changes in configuration: 0
Number of changes to accounts, groups, or roles: 0
Number of logins: 0
Number of failed logins: 0
Number of authentications: 1
Number of failed authentications: 0
Number of users: 1
Number of terminals: 2
Number of host names: 1
Number of executables: 3
Number of files: 0
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 0
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of process IDs: 105
Number of events: 111

You must be login first or sign-up for an account to post comments.