---
title: "box.audit"
canonical: "https://docs.devo.com/space/latest/94664891/box.audit"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `box.audit` identify events generated by <span style="color: #172b4d">[go-audit Linux auditing](https://github.com/slackhq/go-audit)</span>. 

## Valid tags and data tables

<span style="color: #282828">The full tag must have </span><span style="color: #000000">at least 3</span><span style="color: #282828"> levels. The first two are fixed as</span><span style="color: #ff0000">** **</span>`box.audit`<span style="color: #282828">. The third level identifies the type of events sent, and the fourth level indicates the event subtype. </span>

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| UNIX audit | `box.audit.unix` | `box.audit.unix`<br>> ⚠️ **Union table**
> ⚠️ 
> ⚠️ This is a union table that collects events from a set of tables for easy access and analysis.
> ⚠️ 
> ⚠️ Learn more about this union table [in this article](https://docs.devo.com/space/latest/313262155). |
| `box.audit.unix.audispd` | `box.audit.unix.audispd` |
| `box.audit.unix.auditd` | `box.audit.unix.auditd` |
| `box.audit.unix.go-audit` | `box.audit.unix.goAudit` |

For more information, read more [About Devo tags](https://docs.devo.com/space/latest/95126204).

## Send it

### Direct sending

When using [secure sending using rsyslog](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94658323), modify the configuration to use this template:

```
template(
    name = "box-unix-audit"
    type = "string"
    string = "<%PRI%>%timegenerated% %HOSTNAME% box.audit.unix.auditd %msg%"
)
```

### Example [relay rule](https://docs.devo.com/space/latest/96469377/Defining+a+relay+rule)

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: box.audit.unix.auditd
Sent without syslog tag: false
        Stop processing: false
```


When using [simple sending using rsyslog](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94658310) with the relay, modify the configuration to use the template mentioned above:

```
template(
    name = "box-unix-audit"
    type = "string"
    string = "<%PRI%>%timegenerated% %HOSTNAME% box.audit.unix.auditd %msg%"
)
```

## Table structure

These are the fields displayed in these tables:

- [box.audit.unix.audispd](#tag1)
- [box.audit.unix.auditd](#tag2)
- [box.audit.unix.goAudit](#tag3)

### > Macro (anchor)

box.audit.uni.audispd

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *machine* | `str` | *vmachine* |  |
| *node* | `str` |  |  |
| *type* | `str` |  |  |
| *audit_timestamp* | `str` |  |  |
| *audit_id* | `str` |  |  |
| *pid* | `str` |  |  |
| *uid* | `str` |  |  |
| *gid* | `str` |  |  |
| *auid* | `str` |  |  |
| *ses* | `str` |  |  |
| *old_auid* | `str` |  |  |
| *old_ses* | `str` |  |  |
| *op* | `str` |  |  |
| *opType* | `str` |  |  |
| *acct* | `str` |  |  |
| *id* | `str` |  |  |
| *exe* | `str` |  |  |
| *hostname* | `str` |  |  |
| *addr* | `str` |  |  |
| *terminal* | `str` |  |  |
| *res* | `str` |  |  |
| *comm* | `str` |  |  |
| *reason* | `str` |  |  |
| *sig* | `str` |  |  |
| *dev* | `str` |  |  |
| *prom* | `str` |  |  |
| *old_prom* | `str` |  |  |
| *fver* | `str` |  |  |
| *fp* | `str` |  |  |
| *fi* | `str` |  |  |
| *fe* | `str` |  |  |
| *old_pp* | `str` |  |  |
| *old_pi* | `str` |  |  |
| *old_pe* | `str` |  |  |
| *old_pa* | `str` |  |  |
| *pp* | `str` |  |  |
| *pi* | `str` |  |  |
| *pe* | `str` |  |  |
| *pa* | `str` |  |  |
| *grantors* | `str` |  |  |
| *kind* | `str` |  |  |
| *direction* | `str` |  |  |
| *spid* | `str` |  |  |
| *suid* | `str` |  |  |
| *cipher* | `str` |  |  |
| *ksize* | `str` |  |  |
| *mac* | `str` |  |  |
| *pfs* | `str` |  |  |
| *rport* | `str` |  |  |
| *laddr* | `str` |  |  |
| *lport* | `str` |  |  |
| *cwd* | `str` |  |  |
| *argc* | `str` |  |  |
| *a0* | `str` |  |  |
| *a1* | `str` |  |  |
| *a2* | `str` |  |  |
| *a3* | `str` |  |  |
| *tty* | `str` |  |  |
| *table* | `str` |  |  |
| *family* | `str` |  |  |
| *entries* | `str` |  |  |
| *item* | `str` |  |  |
| *name* | `str` |  |  |
| *inode* | `str` |  |  |
| *mode* | `str` |  |  |
| *ouid* | `str` |  |  |
| *ogid* | `str` |  |  |
| *rdev* | `str` |  |  |
| *objtype* | `str` |  |  |
| *cap_fp* | `str` |  |  |
| *cap_fi* | `str` |  |  |
| *cap_fe* | `str` |  |  |
| *cap_fver* | `str` |  |  |
| *proctitle* | `str` |  |  |
| *arch* | `str` |  |  |
| *syscall* | `str` |  |  |
| *compat* | `str` |  |  |
| *ip* | `str` |  |  |
| *code* | `str` |  |  |
| *unit* | `str` |  |  |
| *saddr* | `str` |  |  |
| *sw* | `str` |  |  |
| *sw_type* | `str` |  |  |
| *key_enforce* | `str` |  |  |
| *gpg_res* | `str` |  |  |
| *root_dir* | `str` |  |  |
| *success* | `str` |  |  |
| *exit* | `str` |  |  |
| *items* | `str` |  |  |
| *ppid* | `str` |  |  |
| *euid* | `str` |  |  |
| *fsuid* | `str` |  |  |
| *egid* | `str` |  |  |
| *sgid* | `str` |  |  |
| *fsgid* | `str` |  |  |
| *key* | `str` |  |  |
| *new_level* | `str` |  |  |
| *old_level* | `str` |  |  |
| *cmd* | `str` |  |  |
| *user* | `str` |  |  |
| *ctr_id_short* | `str` |  |  |
| *vm_pid* | `str` |  |  |
| *vm* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` |  | **✓** |
| *rawMessage* | `str` |  | **✓** |

### > Macro (anchor)

box.audit.unix.auditd

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  | * * |  |
| *machine* | `str` |  | *vmachine* |  |
| *type* | `str` |  | * * |  |
| *msg_audit* | `str` |  | * * |  |
| *msg_audit_timestamp* | `str` |  | * * |  |
| *msg_audit_id* | `str` |  | * * |  |
| *pid* | `str` |  | * * |  |
| *ppid* | `str` |  | * * |  |
| *uid* | `str` |  | * * |  |
| *gid* | `str` |  | * * |  |
| *gid_2* | `str` |  | * * |  |
| *auid* | `str` |  | * * |  |
| *auid_2* | `str` |  | * * |  |
| *tty* | `str` |  | * * |  |
| *old_ses* | `str` |  | * * |  |
| *ses* | `str` |  | * * |  |
| *grantors* | `str` |  | * * |  |
| *comm* | `str` |  | * * |  |
| *reason* | `str` |  | * * |  |
| *sig* | `str` |  | * * |  |
| *dev* | `str` |  | * * |  |
| *prom* | `str` |  | * * |  |
| *old_prom* | `str` |  | * * |  |
| *audit_backlog_limit* | `str` |  | * * |  |
| *audit_backlog_wait_time* | `str` |  | * * |  |
| *audit_failure* | `str` |  | * * |  |
| *old* | `str` |  | * * |  |
| *key* | `str` |  | * * |  |
| *list* | `str` |  | * * |  |
| *old_auid* | `str` |  | * * |  |
| *old_auid_2* | `str` |  | * * |  |
| *cwd* | `str` |  | * * |  |
| *subj* | `str` |  | * * |  |
| *ver* | `str` |  | * * |  |
| *format* | `str` |  | * * |  |
| *kernel* | `str` |  | * * |  |
| *uid_2* | `str` |  | * * |  |
| *table* | `str` |  | * * |  |
| *family* | `str` |  | * * |  |
| *entries* | `str` |  | * * |  |
| *item* | `str` |  | * * |  |
| *name* | `str` |  | * * |  |
| *nametype* | `str` |  | * * |  |
| *inode* | `str` |  | * * |  |
| *mode* | `str` |  | * * |  |
| *ouid* | `str` |  | * * |  |
| *ouid_2* | `str` |  | * * |  |
| *ogid* | `str` |  | * * |  |
| *ogid_2* | `str` |  | * * |  |
| *saddr* | `str` |  | * * |  |
| *saddr_2* | `str` |  | * * |  |
| *sauid_2* | `str` |  | * * |  |
| *lsm* | `str` |  | * * |  |
| *rdev* | `str` |  | * * |  |
| *objtype* | `str` |  | * * |  |
| *cap_fp* | `str` |  | * * |  |
| *cap_fi* | `str` |  | * * |  |
| *cap_fe* | `str` |  | * * |  |
| *cap_fver* | `str` |  | * * |  |
| *cap_frootid* | `str` |  | * * |  |
| *proctitle* | `str` |  | * * |  |
| *a0* | `str` |  | * * |  |
| *a1* | `str` |  | * * |  |
| *a2* | `str` |  | * * |  |
| *a3* | `str` |  | * * |  |
| *a4* | `str` |  | * * |  |
| *a5* | `str` |  | * * |  |
| *a6* | `str` |  | * * |  |
| *a7* | `str` |  | * * |  |
| *a8* | `str` |  | * * |  |
| *a9* | `str` |  | * * |  |
| *a10* | `str` |  | * * |  |
| *arch* | `str` |  | * * |  |
| *arch_2* | `str` |  | * * |  |
| *argc* | `str` |  | * * |  |
| *syscall* | `str` |  | * * |  |
| *syscall_2* | `str` |  | * * |  |
| *success* | `str` |  | * * |  |
| *exit* | `str` |  | * * |  |
| *items* | `str` |  | * * |  |
| *euid* | `str` |  | * * |  |
| *euid_2* | `str` |  | * * |  |
| *fsuid* | `str` |  | * * |  |
| *fsuid_2* | `str` |  | * * |  |
| *egid* | `str` |  | * * |  |
| *egid_2* | `str` |  | * * |  |
| *sgid* | `str` |  | * * |  |
| *sgid_2* | `str` |  | * * |  |
| *fsgid* | `str` |  | * * |  |
| *fsgid_2* | `str` |  | * * |  |
| *res* | `str` |  | * * |  |
| *state* | `str` |  | * * |  |
| *exe* | `str` |  | * * |  |
| *op* | `str` |  | * * |  |
| *op_type* | `str` |  | * * |  |
| *msg* | `str` |  | * * |  |
| *msg_old_level* | `str` |  | * * |  |
| *msg_new_level* | `str` |  | * * |  |
| *msg_op* | `str` |  | * * |  |
| *msg_acct* | `str` |  | * * |  |
| *msg_exe* | `str` |  | * * |  |
| *msg_hostname* | `str` |  | * * |  |
| *msg_addr* | `str` |  | * * |  |
| *msg_terminal* | `str` |  | * * |  |
| *msg_res* | `str` |  | * * |  |
| *msg_kind* | `str` |  | * * |  |
| *msg_fp* | `str` |  | * * |  |
| *msg_direction* | `str` |  | * * |  |
| *msg_spid* | `str` |  | * * |  |
| *msg_suid* | `str` |  | * * |  |
| *msg_comm* | `str` |  | * * |  |
| *msg_rport* | `str` |  | * * |  |
| *msg_laddr* | `str` |  | * * |  |
| *msg_lport* | `str` |  | * * |  |
| *msg_cipher* | `str` |  | * * |  |
| *msg_ksize* | `str` |  | * * |  |
| *msg_mac* | `str` |  | * * |  |
| *msg_pfs* | `str` |  | * * |  |
| *msg_id* | `str` |  | * * |  |
| *msg_id_2* | `str` |  | * * |  |
| *msg_auid* | `str` |  | * * |  |
| *msg_unit* | `str` |  | * * |  |
| *msg_sw* | `str` |  | * * |  |
| *msg_sw_type* | `str` |  | * * |  |
| *msg_key_enforce* | `str` |  | * * |  |
| *msg_gpg_res* | `str` |  | * * |  |
| *msg_root_dir* | `str` |  | * * |  |
| *msg_size* | `str` |  | * * |  |
| *hostchain* | `str` |  | * * | **✓** |
| *tag* | `str` |  | * * | **✓** |
| *message* | `str` |  | *rawMessage* | **✓** |
| *rawMessage* | `str` |  | * * | **✓** |

### > Macro (anchor)

box.audit.unix.goAudit

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *machine* | `str` | *vmachine* |  |
| *sequence* | `int8` |  |  |
| *timestamp* | `timestamp` |  |  |
| *messages* | `str` |  |  |
| *uid_map* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` |  | **✓** |
| *rawMessage* | `str` |  | **✓** |