# Parsing logs from audit.log from /var/log/audit/audit.log **URL:** \ **Category:** Logstash\ **Created:** [March 29, 2020, 7:39pm UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577 "2020-03-29T19:39:18Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Post date:** [March 29, 2020, 7:39pm UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577/1 "2020-03-29T19:39:19Z")
Logfile contents `type=USER_END msg=audit(1585509001.049:14007): pid=15642 uid=0 auid=0 ses=1100 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'` ```auto input { file { path => " /var/log/audit/audit.log" start_position => "beginning" type => "audit" start_position => beginning sincedb_path => "/dev/null" ignore_older => 0 } } filter { if [type] == "audit"{ grok { match => { "message" => "type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} auid=%{NUMBER:audit_audid} ses=%{NUMBER:ses} msg=\'op=%{WORD:operation}:%{WORD:detail_operation} grantors=%{WORD:pam_login},%{WORD:pam_key},%{WORD:pam_limit},%{WORD:pam_system} acct=\"%{WORD:acct_user}\" exe=\"%{GREEDYDATA:exec}\" hostname=%{GREEDYDATA:hostname} addr=%{GREEDYDATA:ipaddr} terminal=%{WORD:terminal} res=%{WORD:result}\'" } } date { match => ["audit_epoch", "UNIX_MS"] } mutate { split => ["host", "."] add_field => { "hostname" => "%{[host][0]}" } add_field => { "podName" => "%{[host][1]}" } add_field => { "ignore" => "%{[host][2]}" } remove_field => ["ignore", "host"] } } } output { if [type] == "audit" { stdout { codec => rubydebug } } } ``` error : [ERROR] 2020-03-29 19:34:58.462 [[main]-pipeline-manager] javapipeline - Pipeline aborted due to error {:pipeline\_id=\>"main", :exception=\>#\, :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:275:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:273:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:191:in `block in register\_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:190:in `register\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:280:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:244:in `start\_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:145:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:104:in `block in start'"], :thread=\>"#\"} [ERROR] 2020-03-29 19:34:58.486 [Converge PipelineAction::Create] agent - Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil} [DEBUG] 2020-03-29 19:34:58.552 [LogStash::Runner] os - Stopping Please help to resolve the error. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 29, 2020, 11:14pm UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577/2 "2020-03-29T23:14:20Z")
> [@ranjini](#): > > path =\> " /var/log/audit/audit.log" There is a leading space in your path, so this is effectively "./ /var/log/audit/audit.log" and that results in the error 'ArgumentError: File paths must be absolute, relative path specified'. ---
**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Post date:** [March 30, 2020, 5:21am UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577/3 "2020-03-30T05:21:59Z")
Thank you for the solution, yes it worked when removing the space as you mentioned. Now I have encountered date parse failure. This is the log file : ```auto ``` filter: ```auto grok { match => { "message" => "type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} auid=%{NUMBER:audit_audid} ses=%{NUMBER:ses} msg=\'op=%{WORD:operation}:%{WORD:detail_operation} grantors=%{WORD:pam_login},%{WORD:pam_key},%{WORD:pam_limit},%{WORD:pam_system} acct=\"%{WORD:acct_user}\" exe=\"%{GREEDYDATA:exec}\" hostname=%{GREEDYDATA:hostname} addr=%{GREEDYDATA:ipaddr} terminal=%{WORD:terminal} res=%{WORD:result}" } } date { match => ["audit_epoch", "UNIX_MS"] } mutate { split => ["host", "."] add_field => { "hostname" => "%{[host][0]}" } add_field => { "myName" => "%{[host][1]}" } add_field => { "ignore" => "%{[host][2]}" } remove_field => ["ignore", "host"] } ``` ---
**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Post date:** [March 30, 2020, 5:22am UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577/4 "2020-03-30T05:22:49Z")
log file contents type=USER\_START msg=audit(1585543849.155:15332): pid=9606 uid=0 auid=1000 ses=1198 msg='op=PAM:session\_open grantors=pam\_keyinit,pam\_keyinit,pam\_limits,pam\_systemd,pam\_unix,pam\_xauth acct="root" exe="/usr/bin/su" hostname=abc-de-01234edsf.ohai-new7.local addr=? terminal=pts/1 res=success' ---
**Author:** ![Robo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robo/32/38295_2.png) [@Robo](https://discuss.elastic.co/u/Robo)\ **Post date:** [March 30, 2020, 9:40am UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577/5 "2020-03-30T09:40:52Z")
try to use: ``` grok { match => { "message" => "type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch:timestamp}:%{NUMBER:audit_counter}\): pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} auid=%{NUMBER:audit_audid} ses=%{NUMBER:ses} msg=\'op=%{WORD:operation}:%{WORD:detail_operation} grantors=%{WORD:pam_login},%{WORD:pam_key},%{WORD:pam_limit},%{WORD:pam_system} acct=\"%{WORD:acct_user}\" exe=\"%{GREEDYDATA:exec}\" hostname=%{GREEDYDATA:hostname} addr=%{GREEDYDATA:ipaddr} terminal=%{WORD:terminal} res=%{WORD:result}" } } ``` ---
**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Post date:** [March 30, 2020, 11:05am UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577/6 "2020-03-30T11:05:52Z")
There are date parse failure and grok failure please tell me how to resolve tags:\_dateparsefailure terminal:cron pam\_login:pam\_loginuid pam\_system:pam\_systemd acct\_user:root myname:abc\_g1 pam\_key:pam\_keyinit audit\_pid:26122 detail\_operation:session\_close operation:PAM hostname:?, abc-123-aw3ed exec:/usr/sbin/crond audit\_epoch:1585302001.531 result:success audit\_audid:0 message:type=USER\_END msg=audit(1585302001.531:6789): pid=26122 uid=0 auid=0 ses=537 msg='op=PAM:session\_close grantors=pam\_loginuid,pam\_keyinit,pam\_limits,pam\_systemd acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' path:/var/log/audit/audit.log audit\_counter:6789 ipaddr:? audit\_type:USER\_END ses:537 pam\_limit:pam\_limits audit\_uid:0 type:audit \_id:SeoWK3EBMRsGEO0Fx1EX \_type:\_doc \_index:abc-123-aw70-audit-final- \_score:2.045 tags:\_grokparsefailure myname:abc\_g1 message:type=SERVICE\_STOP msg=audit(1585296872.086:6648): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-hostnamed comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' hostname:abc-123-aw3ed path:/var/log/audit/audit.log type:audit \_id:vOoWK3EBMRsGEO0Fx1AO \_type:\_doc \_index:abc-123-aw70-audit-final- \_score:0.16 filter used ````auto filter { if [type] == "audit"{ grok { match => { "message" => "type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch:timestamp}:%{NUMBER:audit_counter}\): pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} auid=%{NUMBER:audit_audid} ses=%{NUMBER:ses} msg=\'op=%{WORD:operation}:%{WORD:detail_operation} grantors=%{WORD:pam_login},%{WORD:pam_key},%{WORD:pam_limit},%{WORD:pam_system} acct=\"%{WORD:acct_user}\" exe=\"%{GREEDYDATA:exec}\" hostname=%{GREEDYDATA:hostname} addr=%{GREEDYDATA:ipaddr} terminal=%{WORD:terminal} res=%{WORD:result}" } } date { match => ["audit_epoch", "UNIX_MS"] } mutate { remove_field => ["@timestamp", "@version"] } mutate { split => ["host", "."] add_field => { "hostname" => "%{[host][0]}" } add_field => { "podName" => "%{[host][1]}" } add_field => { "ignore" => "%{[host][2]}" } remove_field => ["ignore", "host"] } ``` ```` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 29, 2020, 4:17am UTC](https://discuss.elastic.co/t/parsing-logs-from-audit-log-from-var-log-audit-audit-log/225577/9 "2020-04-29T04:17:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.