Numeric values of Audit event types

Audit message types have numeric identifiers grouped by functional ranges. These values are important not only for determining a record's purpose, but also for understanding which records may be part of a composite Audit event (multi-record event).

In Audit 3.x the following main classification is used:

• 1000–1099 — control commands of the Audit subsystem;
• 1100–1199 — messages from trusted user-space applications;
• 1200–1299 — internal messages of the daemon auditd;
• 1300–1399 — main audit events;
• 1400–1499 — access control events;
• 1500–1599 — kernel LSPP events;
• 1600–1699 — kernel cryptographic events;
• 1700–1799 — kernel anomalies;
• 1800–1899 — integrity control events;
• 1900–2099 — reserved and service ranges;
• 2100–2499 — miscellaneous user-space events;
• 2500–2999 — reserved for future use in user space.

In Audit 4.x the overall numbering scheme remains, but the classification of individual ranges has been refined. In particular, 1400–1499 is designated for SELinux, 1500–1599 — for AppArmor, 2500–2599 — for virtualization management events, and 2600–2999 is left for future user-space event types.

Starting with Audit 4.0, the definitions of Audit record types (AUDIT_*) have been moved into a separate header file audit-records.h.

Simple and composite events

It is necessary to distinguish record type (record type) and Audit event (event). A single event may consist of one or several records of different types. Records belonging to one event have the same event identifier in the field:

msg=audit(timestamp:serial)

For example, a system call execution event may consist of several records:

SYSCALL → EXECVE → CWD → PATH → PROCTITLE

The main part of such records belongs to the range 1300–1399 — Audit event messages. It includes, in particular, SYSCALL, PATH, CWD, EXECVE, SOCKADDR, PROCTITLE and other records that can be combined into a single composite event.

Thus, the range 1300–1399 is especially important when processing composite system audit events: a single operation in the operating system may generate several records that must be considered together by the common identifier msg=audit(...:serial).

The ranges 1100–1199 mainly contain events created by trusted user-space applications, for example authentication events and user sessions (USER_AUTH, USER_ACCT, USER_LOGIN, USER_START, USER_END etc.). Such events are often represented by individual records and do not require combining a set of SYSCALL/PATH/CWD for interpretation.

References:

https://github.com/linux-audit/audit-kernel/blob/main/include/uapi/linux/audit.h

https://github.com/linux-audit/audit-userspace/blob/master/lib/libaudit.h