aureport is a tool that produces summary reports of the audit system log.

Without any parameters, aureport will generate a summary report of audit activity.

sudo aureport

result:

Summary Report
======================
Range of time in logs: 16/07/16 01:32:46.053 - 16/07/16 10:34:01.482
Selected time for report: 16/07/16 01:32:46 - 16/07/16 10:34:01.482
Number of changes in configuration: 2
Number of changes to accounts, groups, or roles: 0
Number of logins: 0
Number of failed logins: 0
Number of authentications: 2
Number of failed authentications: 1
Number of users: 4
Number of terminals: 14
Number of host names: 6
Number of executables: 107
Number of commands: 155
Number of files: 186
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 33
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of integrity events: 0
Number of virt events: 0
Number of keys: 8
Number of process IDs: 29325
Number of events: 31471

This shows some important information.

For example, it shows that there was a failed authentication.

Using aureport, we can drill down to that information.

We can use this command to look deeper on failed authentication:

sudo aureport -au

result:

Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 16/07/16 07:21:50 anonymous ::ffff:198.20.70.114 ftp /usr/sbin/vsftpd no 3104248
2. 16/07/16 09:07:47 peter ? /dev/pts/0 /usr/bin/sudo yes 3106600
3. 16/07/16 10:33:53 peter ? /dev/pts/0 /usr/bin/sudo yes 3107479

Row 1 has a “no” near the end of the line, which indicates that authentication failed.

Use the -m parameter.

sudo areport -m

result:

=================================================
# date time auid addr term exe acct success event
=================================================
<no events of interest were found>