Audit logging
-
operates according to defined audit rules automatically creating audit logs whenever specified actions or changes occur on the router
-
integrates with the Linux Audit Daemon to monitor and log relevant security events across the router, and
-
allows forwarding of audit logs to a remote syslog server.
-
tracks and logs system calls, file accesses, user actions, and other events as specified by audit rules, and
-
provides administrators with insights to detect suspicious behavior and maintain system integrity.
An audit rule is a configuration that
-
specifies which files, directories, or system events should be monitored
-
determines the conditions for monitoring, and
-
forms the foundation of an audit logging system.
An Audit log is a chronological record that
-
is automatically generated when a monitored event, as defined by an audit rule, occurs, and
-
typically includes details such as the event type, timestamp, user or process involved, and affected resources.
Audit rules and audit logs for security monitoring
Administrators define audit rules to track changes to sensitive files, monitor system calls, and observe other critical activities. By customizing audit rules, organizations can align monitoring with their unique security and compliance requirements.
Audit rules establish what to watch, while audit logs capture and document every relevant occurrence, ensuring a complete and actionable history of system activity.
For example, an audit rule that monitors changes to /etc/passwd file creates an audit log entry each time this file is modified.
Audit logging is not to be confused with system logging. While audit logging records security-relevant events, such as user actions and changes to sensitive files, system logging (syslog) captures general system events like service status updates, routine errors, or informational messages.
How audit logging works
Summary
These are the key components involved in this feature:
-
Network Administrator: The user who initiates configurations via CLI.
-
Linux audit daemon : The process that monitors system activity according to the installed rules and writes audit event logs.
-
Local rsyslog daemon: The process that forwards logs to a remote syslog server.
-
Remote syslog server: The external server that maintains the logs generated by the router.
The Linux audit daemon is the core service that actually performs event monitoring and logging, based on the audit rules configured by the administrator. It operates at the operating system level on each node, such as line cards and processors.
Workflow
These stages describe how audit monitoring and logging works.
- The network administrator enables audit monitoring via CLI.
- The router software receives the configurations, applies the relevant audit rules, and ensures these rules are distributed to all appropriate nodes.
- On each node, the Linux audit daemon actively monitors system events as defined by the audit rules and writes the logs to a local log file at /var/log/audit/audit.log.
- If the network administrator has enabled log forwarding, the audit logs are sent to the local rsyslog daemon, which then forwards the logs to a remote syslog server.
Guidelines for audit logging
Granularity of audit rules
-
You can enable or disable audit rules only at the group level, not individually within a group.
-
Regularly review the status of audit rules and audit log forwarding to ensure monitoring remains effective.
Resource usage on NCS 1020
Use caution when enabling all rule groups, especially those that monitor frequent events, as this may increase CPU, memory, or disk usage. Enable only the groups required for compliance or security needs.
Security of audit logs and syslog servers
-
Allow only users with appropriate administrative privileges to configure or view Linux security audit settings.
-
Protect access to audit logs and syslog servers to prevent unauthorized access or tampering.
Log forwarding to remote syslog servers
-
Confirm that the remote syslog server is reachable and properly configured before enabling log forwarding.
-
NCS 1020 forwards audit logs to remote syslog servers in unencrypted plain text. Use only trusted network segments for remote syslog servers.
Notes about audit log storage
-
NCS 1020 stores audit logs locally at /var/log/audit/audit.log , unless you enable log forwarding.
-
By default, the system rotates up to five audit log files, each up to 8 MB in size.
Configure audit logging
Follow this task to configure and monitor audit logs for specific system events by enabling the relevant audit rule groups.
Procedure
|
Step 1 |
Execute the linux security audit monitor <group-keyword> command, to enable a group of audit rules. Example: |
|
Step 2 |
Run the show linux security audit monitor status command, to verify the general status of all active audit rule groups. Example: |
|
Step 3 |
(Optional) Execute the linux security audit logging syslog command, to enable forwarding of audit rules. Example: |
|
Step 4 |
(Optional) Execute the logging remote-server-ip vrf vrf-name command, to configure the remote syslog server. Example: |
|
Step 5 |
(Optional) Run the show linux security audit logging syslog command, to verify whether audit log forwarding is enabled and to view the configured remote syslog server. Example: |
Feedback