Linux Audit Logs

So I had to dig through the Linux audit logs the other day and it was a bit painful to look at.

sealrert - this lets you read alerts that are in your audit log file.
I think you have to install it with yum install setroubleshoot-server
It isn't the best but it if you want the basics

yum install setroubleshoot-server
After the install is completed, you can then analyze the audit log by issuing the following command:

sealert -a /var/log/audit/audit.log > /var/log/audit/audit_human_readable.log

rcauditd is an audit service that makes it much easier to understand things.

I found the summary to be quite useful as it is literally a quick view of everything.
aureport --summary

This let me see basically everything I wanted to and specify time frame as well as other useful things like who logged in etc.

A good link is:
https://www.suse.com/documentation/sles11/singlehtml/audit_quickstart/audit_quickstart.html

Linux/Windows/Mac and Opinion

I will try to not be exclusive in the future with the how to's etc. If someone really needs me to convert something I have written to a different OS ask. I have comments open for a reason and will do my best, or feel free to email me. The rest of this post is kinda rant like so feel free to skip it.

So I am a windows user and have been for an extremely long time, but mostly by culture not by choice. Essentially Windows was chosen for me many times and I've just gone with it. I have looked at Apple and played with it a bit but in all honesty I am starting to fall in love with Linux distros.

1) They are FREE 99
2) They come with the things you need when working as an admin.
3) Updates are much easier to handle and control I feel.

Reasons why I will ALWAYS own a windows machine (or VM):
1) Gaming - people don't develop games as much for linux
2) Excel - It is the most robust tool for any financial things and although I am not an expert with it (nor an accountant) I get files that are in Excel format and can't always change/convert.

So From what I have found it comes down to why are you using the machine. I have something like 5 or 6 (or maybe closer to 10) computers in my house and I use each for different reasons. In working as an Administrator I have found you pretty much have to use Linux at some point and so I am learning what I can replace on Windows with Linux alternatives and for somethings it is just easier for me to do in Windows because I have done it that way for so long.
So I guess I am going to re-install some of my computers with Linux.

I decided to comment on Mac as well. I own a really really old (over 10 years) MacBook but I'm a poor guy so I am not able to speculate on Mac. Nor will I include any mac stuff in my how to's as I can't test it.

Task oriented

I am a very task oriented person.
Pen and paper works best for me. something about hand writing it helps me.

other options:
Evernote:
I was not a big fan of, mostly because writing it down kept me more focused. It does allow you to do many more things though so if you are a good note taker and have lots of notes this is a nice application.

I stole the image from Google (I think it actually came from the evernote blog).

Google tasks:
https://mail.google.com/tasks/canvas
Lets you have multiple lists. I use this one for goals for myself rather than actual tasks.
Your phone task list - I never got this one down but for some people it is a quick task list they need.

Another one that I have used is Asana.
This is a nice way for a manager to assign tasks as well as it makes it easy to break things down to different levels and make projects. This was very nice for me when my tasks changed daily on what I needed to work on as my manager could see what I was doing and assign things different priorities. The best part about it is the hidden unicorn feature.

Same thing for this image as the Evernote one.

Microsoft Security Essentials Logs

So there may come a time when you need to know what has happened with your virus scans for reporting or anything really (for me it was reporting). Well when that happens here is how you can find your logs in Microsoft Security Essentials.

Microsoft Security Essentials (MSE) actually logs all of its scans and findings, although you can't find them in the program itself. It logs them to the event viewer.

There are a couple of options:

1) Find and create a filter for the specific logging you want.

2) There is a built in dump of all of the logs to one file called MpCmdRun

To run the built in option simply open an administrator command prompt and go to the directory where it is located. 

cd %programfiles%\Microsoft Security Essential

[add pic]

Then run "MpCmdRun.exe -getfiles"

It takes a bit to run sometimes depending on how often and how many logs there are.

It makes a file called MPSupportFiles.cab which will be saved automatically to "%ProgramData%\Microsoft\Microsoft Antimalware\Support\" folder

[add pic]

The other option lets you export an XML so you can then import that into MySQL or anything really. I will get a query once I test it out again.

You can also use the Event Viewer (Start > Run > eventvwr.msc) under [System] right click View > filter (by Event Source: Microsoft Antimalware) 

I usually make the filter for a week so I don't get too much data.

I filter out the update events but other than that here is the xml:

<ViewerConfig><QueryConfig><QueryParams><Simple><BySource>True</BySource><Channel>System</Channel><Source>Microsoft Antimalware</Source><RelativeTimeInfo>4</RelativeTimeInfo><EventId>-2000</EventId></Simple></QueryParams><QueryNode><Name>MSE Events</Name><QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='Microsoft Antimalware'] and TimeCreated[timediff(@SystemTime) &lt;= 604800000]]]</Select><Suppress Path="System">*[System[(EventID=2000)]]</Suppress></Query></QueryList></QueryNode></QueryConfig></ViewerConfig>

It is all in one line. To export it to a database it is easier to use powershell but that was a project in and of itself so I am not going to go over that in this post.

How to reduce the root partition in LVM

So at work I ended up being told two different things. First I was told use all of the disk space so that we can get an LVM with as much size on it as possible. Then I was told oh we need 20 percent or so so that we can use it for backing up. With that I set out on a mission to find out how to resize LVM space. We come to find out we put the root partition in the LVM. This means we have a few more steps to do.

A few sites mention how to do this but I found one step by step guide with pictures the rest were not as informative as this site and we were using the same distro so I chose to use this for my base documentation. Other changes include a few grammer tweaks.

Best practice would be to make sure you don't have to shrink your LVM as it can become corrupt, and it is much easier to enlarge it.

Modified from:

https://rbgeek.wordpress.com/2013/02/11/how-to-reduce-the-root-partition-in-lvm/

My additions are in blue comments and have brackets
In this tutorial, I am using the CentOS 6 (I believe that its also applicable on other Linux distro but haven't tried yet) that has ext4 partition lv_root mounted as / and lv_swap as swap from the volume group vg_centos6 (which is default), that has two hard drives (66GB & 25GB). Due to some reasons, I want to remove the 25GB hard drive from my computer and want to add new 50 GB hard drive. Before, removing the hard drive from the computer, we need to resize the lv_root, then remove it from volume group and at the end from the physical volume.

WARNING: It’s really dangerous, so backup your data before attempting this. Please don’t blame me, if you destroy your system. You are responsible for your own actions!

Check the size of lv_root before starting this process:

df -h



Boot from CentOS 6 DVD (or any other Linux distro that you are using) and select “rescue” option:



[The next thing I chose to do was I selected to enable the em0 (the ethernet device adapter) incase I needed it for any reason. This was not a step mentioned in the tutorial I took this from.]

Select the Skip, so that it will not mount the filesystem:



Run these commands:

pvscan
vgscan
vgchange -a y
lvscan



Display the lv_root:

lvdisplay /dev/vg_centos6/lv_root



[This section would not run] fsck on the large root filesystem (lv_root):

fsck.ext4 /dev/vg_centos6/lv_root

]

Run e2fsck with -f (force) option:

e2fsck -f /dev/vg_centos6/lv_root



Issue the resize2fs command to reduce the filesystem (Important: The size here is the actual/total size of thelv_root after reduce, not the size that we want to decrease):

resize2fs -p /dev/vg_centos6/lv_root 65G [I chose to use 2750G as we have 4 terabytes and that is what I calculated to be 20 % ish]



Now, issue the lvreduce command to reduce the logical volume size:

lvreduce -L 65G /dev/vg_centos6/lv_root [Once again I chose to use 2750G]



Run lvdisplay command to confirm the change:

lvdisplay /dev/vg_centos6/lv_root



Reboot the system and login. Remove the disk (in my case it is, /dev/sdb1) from volume group and then from physical volume:

[These next two commands would also not run]

sudo vgreduce vg_centos6 /dev/sdb1

sudo pvremove /dev/sdb1

]

Check the size of lv_root after all these changes:

df -h



Success!