我使用python来减少auditd日志记录，但是我必须在2行中过滤数据。这个日志记录用于任何用户命令：

#!/usr/bin/python3

from sh import tail
from datetime import datetime
import re
import socket
import time

UDP_IP = "127.0.0.1" #changeme (send to remote server)
UDP_PORT = 5555 #changeme (send to remote server)
logfile = '/var/log/audit_commands.log'  #new file to save cutting logs

time.sleep(10)    #if scrypt must work as service on start system
lastRecord=False
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
hostname = socket.gethostname()


def callback(m):
    try:
        m = m.group(0)
        m = m[1:]
        return '='+m.decode('hex')
    except:
        return '='+m

for line in tail("-F", "/var/log/audit/audit.log", _iter=True):
    if lastRecord:
        if "type=EXECVE" in line:
            _,msg=line.strip().split('msg=')
            aid,exe = msg.split(": ",1)
            time, id = aid.split(":",1)
            time = int(time[6:16])
            time = datetime.fromtimestamp(time).strftime("%Y-%m-%d %H:%M:%S")
            exe = exe.split(" ",1)[1]
            exe = re.sub(r'=[0-9A-F]{5,}',callback,exe)
            exe = re.sub(r'a[0-9]=', '',exe)
            exe = re.sub(r'"', '',exe)
            log_entry="timestamp='"+time+"'"+" "+"address='"+hostname+"'"+" "+"comm='"+exe+"'"+"\n"
            #sock.sendto(bytes(log_entry, "utf-8"), (UDP_IP, UDP_PORT)) #uncomment if you set ip/port
            try:
                log_file = open(logfile, 'a')
                log_file.write(log_entry)
                log_file.close()
            except FileNotFoundError:
                pass

    if "type=SYSCALL" and "tty=pts" not in line:
        lastRecord=False
        continue
    lastRecord=True
    _,msg=line.strip().split('msg=')
    aid,exe = msg.split(": ",1)
    time, id = aid.split(":",1)
    time = int(time[6:16])
    time = datetime.fromtimestamp(time).strftime("%Y-%m-%d %H:%M:%S")
    logTable = line.split(' ')
    success=logTable[4]
    comm=logTable[24]
    auid=logTable[29]
    euid=logTable[32]
    log_entry="timestamp='"+time+"'"+" "+"address='"+hostname+"'"+" "+comm+" "+success+" "+auid+" "+euid+"\n"
    #sock.sendto(bytes(log_entry, "utf-8"), (UDP_IP, UDP_PORT))  #uncomment if you set ip/port
    try:
        log_file = open(logfile, 'a')
        log_file.write(log_entry)
        log_file.close()
    except FileNotFoundError:
        pass

我使用以下审核规则：

-a always,exit -F arch=b32 -S execve -k execv
-a always,exit -F arch=b64 -S execve -k execv

现在您可以根据需要进行更改。