ausee

Read Linux audit logs in plain language. Drop audit.log, rotated audit.log.N files, or a .gz / .tar / .tar.gz / .zip of them into the page. You get a timeline of who logged in, when they became root, and which commands they ran.

Everything is parsed in the browser. The page makes no network requests, which its Content-Security-Policy enforces, so logs never leave the machine.

Use it

• Locally: open index.html in a browser.

• Container:

  docker run -d -p 8080:8080 forgejo.dmeg.se/nollverket/ausee:latest
  

  The image is unprivileged nginx on port 8080, with a health endpoint at /healthz.

Seeing commands run as root

By default, auditd only records sudo command lines and login events. To see what people run inside a root shell (sudo -i, su -), add execve rules on the server:

# /etc/audit/rules.d/50-commands.rules
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=unset -k rootcmd
-a always,exit -F arch=b32 -S execve -F euid=0 -F auid>=1000 -F auid!=unset -k rootcmd

Then run augenrules --load.

Development

• index.html: the whole app (parser and UI in one file, no build step)
• test/: parser tests. Run them with node --test (Node 20 or later, no dependencies).
• test/fixtures/make-synthetic.js: regenerates the synthetic test log

CI

.forgejo/workflows/ci.yml does the following:

1. Runs the parser tests.
2. Builds the image and smoke-tests it: nginx -t, /healthz, page content and the CSP header.
3. Pushes to the Forgejo registry:
   • pushes to main are tagged latest and sha-<commit>
   • tags vX.Y.Z are tagged X.Y.Z, X.Y and latest
   • pull requests are built and tested but not pushed

It needs the repository or nollverket organisation secrets REGISTRY_USER (the user that owns the token) and REGISTRY_TOKEN (an access token with write:package scope). Forgejo's automatic Actions token cannot push packages.