ausearch
Query the Linux audit log for events. tldr-pages
On Linux
Linux
Query the Linux audit log for events. Part of the audit package.
Search for all SELinux AVC denial events
sudo ausearch --message avcIdentifySearch for events related to a specific executable
sudo ausearch --comm httpdIdentifySearch for events from a specific user
sudo ausearch --uid 1000IdentifySearch for events in the last 10 minutes
sudo ausearch --start recentIdentifySearch for failed login attempts
sudo ausearch --message user_login --success noIdentifySearch for events related to a specific file
sudo ausearch --file path/to/fileIdentifyDisplay results in raw format for further processing
sudo ausearch --message avc --rawIdentify