The aureport program was designed to aid in doing reports via awk, perl, or grep.

Ausearch is a grep program in that it can be given certain parameters and it will display any records that match. These are two programs, ausearch and aureport, that provide retrieval capabilities. Daemon auditd collects audit subsystem logs and log them on /var/log/audit/audit.log. Search the logs using grep, aureport, ausearch commands. => result: drwx- 5 username username 4096 Aug 28 22:07 /home/username/ģ. Check the creation data of user home directory On Linux Operating System user creation date are analyised by checking home directory creation, messages and auditlog.ġ. System will not create a new profile folder.ģ. *If the user have never login into the Operating System. Profile creation date, help us to know the first login date. It would be good to enable the audit logs. On Windows Operating System user creation date are analyised by checking Event viewers (Event ID 4720), Profiles creation date and net command.ġ. This help us to ensure the validity of the user. Finding user creation date on the Operating system is a key fact on security audit.

Find files by date created windows 8