How can we exclude results from users with tty=(none) in auditd?

ubuntu_ulysses

Is there any way to exclude the event records having tty=(none) I have tried many ways of adding rule but nothing worked out. This is my current log file: > > type=SYSCALL msg=audit(1554390377.124:5): arch=40000003 syscall=11 > > success=yes exit=0 a0=810cf88 a1=810bd88 a2=80f5008 a3=810bd88 items=2 > > ppid=9991 pid=10497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 > > egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="date" > >...

Originally asked by fox18 on Stack Exchange (unix) (CC BY-SA 4.0).

uphilltech

Great question — answering as the UphillTech team:

As far as I understand How to exclude specific users or groups when using auditd to watch files and How to exclude specific users, groups, or services when using auditd to audit syscalls , you could exclude specific services and keys by using filters _F with not ( ! ), i.e. -F subj_type!=SYSCALL and/or -F tty=(none) Maybe you need to add some more specifications.

Full answer by U880D: https://unix.stackexchange.com/a/543093 (CC BY-SA 4.0).

Need it done for your business? UphillTech.