I'm sending my splunk server /var/log/audit.log data from each client machine (splunkforwarder). I have logging of TTY data for root enabled, and would like to be able to read that in splunk. Does anyone know a way to convert the raw data into something readable?
try this:
Example raw log:
type=USER_TTY msg=audit(1573643958.798:1973): pid=2964 uid=0 auid=1000 ses=22 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data=636174202F7661722F6C6F672F61756469742F61756469742E6C6F67207C206772657020555345525F545459UID="root" AUID="rdevega"
splunk code:
your search here
| eval keystrokes = urldecode(replace(data,"([0-9A-F]{2})","%\1"))
| table data keystrokes
results:
It looks like it's a hex string that is just ascii data. I was able to convert the data manually in python. Can anyone point me in the direction of the docs that cover how to run a script against a certain field? I only want it to translate the field "data=" from hex to ascii when the type=TTY
Running into the same issue, can help mention how to tried to extract field "data" into string format.
Thanks.
Can you provide an example of what you see and what you want to see? Are you looking for something like this where you would convert the data within a field? Or are you not getting fields, and wnat to extract them into a fields?
I would like to translate the data=[hex string].
the entry in splunk:
type=TTY msg=audit(1234123.123:6644): tty pid=12345 uid=0 auid=1234 major=137 minor=20 comm="bash" data=121212F0D00DDD0121212423400D host=myhostname | sourcetype=linux_audit | source=/var/log/audit/audit.log
all numbers except uid=0 were replaced with random numbers, as well as the host name.