1
00:00:00,000 --> 00:00:10,880
So what we need is a slight modification to what we have done before.

2
00:00:10,880 --> 00:00:16,780
And I'm going to show you history, pipe, grab, audit, CTL.

3
00:00:16,780 --> 00:00:21,000
So really, it's based on this.

4
00:00:21,000 --> 00:00:22,000
And what do I want?

5
00:00:22,000 --> 00:00:29,000
Well, I want a line that is almost the same, but a little bit more basic.

6
00:00:29,000 --> 00:00:38,560
Audit, CTL, minus A, always comma exit, minus F, there is slash home.

7
00:00:38,560 --> 00:00:44,520
And then I need minus F, UID is zero.

8
00:00:44,520 --> 00:00:50,639
And minus K, root, home, XS.

9
00:00:50,639 --> 00:00:53,000
So that should be doing it.

10
00:00:53,000 --> 00:00:55,520
Now, let's check it.

11
00:00:55,520 --> 00:00:58,480
I'm going in the slash home directory.

12
00:00:58,480 --> 00:01:01,639
And I'm going in the student directory.

13
00:01:01,639 --> 00:01:04,440
And I'm using cat on what?

14
00:01:04,440 --> 00:01:08,160
Well, let's do that on dot bash RC.

15
00:01:08,160 --> 00:01:17,839
And now I'm going to grab root home on var log audit, audit dot log.

16
00:01:17,839 --> 00:01:18,839
And look at that.

17
00:01:18,839 --> 00:01:22,199
There we can see that all root access has been logged.

18
00:01:22,199 --> 00:01:26,680
What you can also see here is that a lot of information is logged.

19
00:01:26,680 --> 00:01:30,800
And one more interesting thing, do you see this number here?

20
00:01:30,800 --> 00:01:33,760
The first part of the number is the timestamp in epoch.

21
00:01:33,760 --> 00:01:39,879
As you have seen, use date minus D at timestamp to see what it is in human time.

22
00:01:39,879 --> 00:01:41,559
Now we have 859.

23
00:01:41,559 --> 00:01:45,160
The 859 is the audit event ID.

24
00:01:45,160 --> 00:01:49,680
And then within the audit event ID, you can see a sequence order.

25
00:01:49,680 --> 00:01:51,239
Now, what does that mean?

26
00:01:51,239 --> 00:01:56,680
We have 859 starting 307 here up to 859 312.

27
00:01:56,680 --> 00:01:59,959
It all belongs to the same flow of events.

28
00:01:59,959 --> 00:02:03,959
So if you want to analyze step by step what exactly has happened,

29
00:02:03,959 --> 00:02:08,720
then you need to read all the lines for all these different events.

30
00:02:08,720 --> 00:02:11,279
But hey, I think this is enough for this lab, isn't it?