Auditd

购买 Self-Hosted Protection
Live
Demo
auditd — 系统审计
缓存: 01:48:20 刷新
Detected 8 login attempts from external IPs
今日登录次数: 3  |  Sudo: 51  |  已拦截: / 8  |  用户: admin
今日登录次数
3
外部登录尝试
8
今日 Sudo 次数
51
Log
11
外部登录尝试 (8)
时间用户IP / 主机终端状态
2026-10-13 01:48:20 root 198.51.100.22 — 未封禁
2026-10-12 23:58:32 root 198.51.100.16 — 未封禁
2026-10-12 16:10:02 root 198.51.100.25 — 未封禁
2026-10-12 04:19:08 root 198.51.100.33 — 未封禁
2026-10-12 10:52:28 root 198.51.100.18 — 未封禁
2026-10-12 19:08:40 root 198.51.100.19 — 未封禁
2026-10-12 12:16:32 root 198.51.100.24 — 未封禁
2026-10-11 14:38:04 root 198.51.100.23 — 未封禁
今日 Sudo 命令数 51 significant / 51 total
时间用户命令结果
2026-10-13 01:48:20 admin /usr/bin/systemctl status fail2ban OK
2026-10-13 01:10:54 admin /usr/bin/apt update OK
2026-10-13 00:50:46 admin /usr/sbin/ufw status OK
2026-10-12 23:42:44 admin /usr/bin/tail -f /var/log/auth.log OK
2026-10-13 00:49:16 admin /usr/bin/docker ps OK
2026-10-13 00:50:20 admin /usr/sbin/fail2ban-client status OK
2026-10-12 23:29:08 admin /usr/bin/systemctl restart nginx OK
2026-10-12 21:41:42 admin /usr/bin/journalctl -u sshd OK
2026-10-12 20:45:40 admin /usr/sbin/aa-status OK
2026-10-12 20:36:29 admin /usr/bin/crontab -l OK
2026-10-12 19:10:20 admin /usr/sbin/lynis audit system OK
2026-10-12 19:42:02 admin /usr/bin/cscli decisions list OK
2026-10-12 16:18:44 admin /usr/bin/systemctl status fail2ban OK
2026-10-12 18:48:00 admin /usr/bin/apt update OK
2026-10-12 18:02:50 admin /usr/sbin/ufw status OK
2026-10-12 23:07:20 admin /usr/bin/tail -f /var/log/auth.log OK
2026-10-12 18:22:28 admin /usr/bin/docker ps OK
2026-10-12 20:26:11 admin /usr/sbin/fail2ban-client status OK
2026-10-12 16:55:14 admin /usr/bin/systemctl restart nginx OK
2026-10-12 19:03:00 admin /usr/bin/journalctl -u sshd OK
2026-10-12 18:15:40 admin /usr/sbin/aa-status OK
2026-10-12 12:14:56 admin /usr/bin/crontab -l OK
2026-10-12 09:15:02 admin /usr/sbin/lynis audit system OK
2026-10-12 08:03:26 admin /usr/bin/cscli decisions list OK
2026-10-12 07:34:20 admin /usr/bin/systemctl status fail2ban OK
2026-10-12 11:26:40 admin /usr/bin/apt update OK
2026-10-12 09:19:02 admin /usr/sbin/ufw status OK
2026-10-12 10:09:11 admin /usr/bin/tail -f /var/log/auth.log OK
2026-10-12 06:52:56 admin /usr/bin/docker ps OK
2026-10-12 12:04:44 admin /usr/sbin/fail2ban-client status OK
2026-10-12 17:59:20 admin /usr/bin/systemctl restart nginx OK
2026-10-12 16:41:42 admin /usr/bin/journalctl -u sshd OK
2026-10-12 00:20:20 admin /usr/sbin/aa-status OK
2026-10-12 12:08:17 admin /usr/bin/crontab -l OK
2026-10-12 04:17:28 admin /usr/sbin/lynis audit system OK
2026-10-12 05:13:25 admin /usr/bin/cscli decisions list OK
2026-10-12 00:23:44 admin /usr/bin/systemctl status fail2ban OK
2026-10-12 16:06:49 admin /usr/bin/apt update OK
2026-10-12 01:21:32 admin /usr/sbin/ufw status OK
2026-10-12 18:35:26 admin /usr/bin/tail -f /var/log/auth.log OK
2026-10-12 17:35:40 admin /usr/bin/docker ps OK
2026-10-11 23:57:10 admin /usr/sbin/fail2ban-client status OK
2026-10-11 23:11:38 admin /usr/bin/systemctl restart nginx OK
2026-10-12 13:05:48 admin /usr/bin/journalctl -u sshd OK
2026-10-12 12:05:32 admin /usr/sbin/aa-status OK
2026-10-11 23:55:05 admin /usr/bin/crontab -l OK
2026-10-11 17:44:00 admin /usr/sbin/lynis audit system OK
2026-10-12 01:18:48 admin /usr/bin/cscli decisions list OK
2026-10-11 23:58:44 admin /usr/bin/systemctl status fail2ban OK
2026-10-12 04:35:58 admin /usr/bin/apt update OK
2026-10-12 02:29:10 admin /usr/sbin/ufw status OK
今日登录 / 登出 (3)
时间类型用户IP / 主机结果状态
2026-10-13 01:48:20 USER_LOGIN admin 203.0.113.20 OK 未封禁
2026-10-12 16:18:55 USER_LOGIN admin 203.0.113.20 OK 未封禁
2026-10-12 10:50:38 USER_LOGIN admin 203.0.113.20 OK 未封禁
/var/log/audit/audit.log

在 ausearch 让人吃力的地方用 Auditd Web UI

Linux 的审计守护进程只记录你要求的东西，一点不多，这让它成为服务器上最精确的工具，同时也是查询起来最难受的工具。ausearch 和 aureport 能用，但它们默认你已经知道自己要找什么，并且还记得那个能找到它的选项。

这一页展示当前已加载的审计规则、被监视的路径与系统调用，以及最新的事件，附带类型、责任进程和结果。看到已加载的规则和看到事件同样重要：空规则集正是 auditd 看起来在跑却什么有价值的东西都没记下的最常见原因。

一套合理的起步规则会盯住 /etc/passwd 与 /etc/shadow 的变更、/etc/ssh/sshd_config 的改动，以及提权类可执行文件的运行。这四项覆盖了入侵通常留下的痕迹，又不会让日志被日常工作的噪音淹没。