Logsign Host OS Audit Events

Purpose

Beyond the audit trail of actions performed in the Logsign user interface, Logsign also records what happens at the operating-system level on the Logsign host itself: account and privilege changes, edits to sensitive configuration files, package installations, interactive commands, and system power state changes. These records are produced by the Logsign maintenance service from the host's own auditd trail and are indexed as Logsign Audit events.

This article lists those events so they can be searched, reported on and alarmed on.

Where these logs appear

The records arrive under the Logsign Audit source (EventSource Prefix ID 4016), with Event.Type set to Audit and Event.Category set to host-audit. You can list them with:

DataType:"system" AND Event.Category:"host-audit"

Each event also carries a numeric Event.VendorID from the table below, and an Event.SystemID formed by prefixing that VendorID with the source prefix (for example VendorID 202623 becomes SystemID 4016202623).

Fields

Event list

How boot, shutdown and reboot are decided

The operating system records a shutdown entry when a clean stop begins and a boot entry early in the next start. Logsign reads both and turns them into the events above:

• A recorded clean stop becomes either system reboot or system shutdown, decided from the shutdown target the system logged at that moment (a restart target produces a reboot event, a power-off or halt target produces a shutdown event).
• Every start produces a system boot event.
• A start with no clean stop recorded since the previous start produces an unexpected shutdown event, marked critical. This is what a power loss, a hard reset or a crash looks like from the host's point of view.

Because a shutdown can only be reported once the machine is running again, the shutdown and reboot events are emitted after the next boot. They still carry the real time of the shutdown in Time.Generated, so the ordering on a timeline is correct.

Notes and Limits

• The very first boot Logsign observes on a host never raises an unexpected shutdown; there is no earlier state to compare it against.
• Login-time and MOTD helper processes are excluded from the command executed events, so the command history reflects what an operator actually typed rather than what runs automatically on every SSH login.
• These events describe the Logsign host's own operating system. Operating-system auditing of your other servers is a separate integration; see the Linux logging model articles.
• Alarms are not shipped for these events by default. To be notified, create an alert on the VendorID or EventMap values above and attach an action rule to it, as described in the system notification articles.