>

Search Linux Audit Logs with ausearch

Query the kernel audit log with ausearch for security-relevant events — logins, file access, or specific commands — in readable form.

LinuxlogsecurityauditMedium risk
Run sudo ausearch -k logins --interpret to show all audit events tagged with the "logins" key in decoded form.

01Command

Command
$ sudo ausearch -k logins --interpret

02What it does

auditd records events according to rules you set with auditctl (for example -w /etc/passwd -p wa -k passwd-changes), and ausearch is the tool that queries the resulting log. The -k option filters events by the key assigned in the rule, while --interpret translates user IDs, timestamps, and syscall numbers into human-readable values — without it the output is mostly numbers. Other useful filters are -ua username (by user), -f /path (by file), and -ts today (time range).

03Risk

RiskMedium risk
Requirementsauditd installed and running (sudo apt install auditd / sudo dnf install audit) with rules defined via auditctl
!Warning: ausearch only shows what audit rules actually captured — with no rules loaded, the log stays nearly empty, so set up auditctl rules for what you want to track.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • ausearch(8) — Ubuntu manual page
    Canonical · community · 2026-09-17
    Evidence: Documents ausearch -k <key> to query audit records by rule key and --interpret to decode numeric fields into readable text.
  • auditctl(8) — Ubuntu manual page
    Canonical · community · 2026-09-17
    Evidence: Shows how audit rules are created with -k keys, which ausearch later uses to filter matching events.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)
LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17
Change file permissions with chmod
LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17
Allow a port through the firewall with ufw
Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17