Data Source: Linux Auditd Daemon Abort

Created: 2024-08-08

Last Updated: 2026-10-14

ID: cc8b3bb0-0fae-4236-9c61-fe2d7138bd63

Author: Teoderick Contreras, Splunk

Description

Logs the execution of processes on a Linux system, including details about the auditd daemon status.

Details

Property	Value
Source	`auditd`
Sourcetype	`auditd`
Separator	type

Name ▲▼	Technique ▲▼	Type ▲▼
Linux Auditd Auditd Daemon Abort	Disable or Modify Linux Audit System Log	Anomaly

Supported Apps

Splunk Add-on for Unix and Linux (version 10.3.4)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">auid</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">msg</span>
  
  <span class="pill kill-chain">op</span>
  
  <span class="pill kill-chain">pid</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">res</span>
  
  <span class="pill kill-chain">ses</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">subj</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">type</span>
  
  <span class="pill kill-chain">uid</span>
  
</div>

Example Log

1type=DAEMON_ABORT msg=audit(06/05/2025 11:03:38.950:6845) : op=set-pid auid=unset pid=61323 uid=root ses=unset subj=unconfined  res=failed

Required Output Fields

op
res
pid
uid
dest

Source: GitHub | Version: 4