Which command included in the Linux Audit system provides searching and filtering of the audit log? (Specify ONLY the command without any path or parameters.) Solution: ausearch Determine whether…

The correct answer is A. Correct. Option A is correct because ausearch is the dedicated command in the Linux Audit framework (auditd) specifically designed to search and filter the audit log (/var/log/audit/audit.log). It allows administrators to query audit records by criteria such as time, user, event type…

Threat Detection and Incident Response

Question

Which command included in the Linux Audit system provides searching and filtering of the audit log? (Specify ONLY the command without any path or parameters.) Solution: ausearch Determine whether the given solution is correct?

Options

ACorrect
BIncorrect

How the community answered

(25 responses)

A
88% (22)
B
12% (3)

Explanation

Option A is correct because ausearch is the dedicated command in the Linux Audit framework (auditd) specifically designed to search and filter the audit log (/var/log/audit/audit.log). It allows administrators to query audit records by criteria such as time, user, event type, or syscall.

There are no distractors listed as alternative answer choices here - the question is a fill-in-the-blank validated against the solution ausearch, and the choices simply ask you to confirm whether that solution is right or wrong. The answer is unambiguously correct because ausearch is the canonical search tool, while the companion tool aureport generates summary reports rather than performing record-level searches.

Memory tip: Think "audit search" → ausearch. Its counterpart aureport is for reporting aggregated stats; if you need to find a specific event, reach for ausearch.

Topics

#Linux Audit#ausearch#Log Filtering#Security Events

Community Discussion

No community discussion yet for this question.

Full 303-300 Practice