Linux Audit Logs

So I had to dig through the Linux audit logs the other day and it was a bit painful to look at.

sealrert - this lets you read alerts that are in your audit log file.
I think you have to install it with yum install setroubleshoot-server
It isn't the best but it if you want the basics

yum install setroubleshoot-server
After the install is completed, you can then analyze the audit log by issuing the following command:

sealert -a /var/log/audit/audit.log > /var/log/audit/audit_human_readable.log

rcauditd is an audit service that makes it much easier to understand things.

I found the summary to be quite useful as it is literally a quick view of everything.
aureport --summary

This let me see basically everything I wanted to and specify time frame as well as other useful things like who logged in etc.

A good link is:
https://www.suse.com/documentation/sles11/singlehtml/audit_quickstart/audit_quickstart.html