Linux Event Code Lookup

Search Linux security & system events by ID, keyword, log, or audit category — with how‑to‑collect steps.

Select an event on the left, or search by ID or keyword, to see full details — description, sample log text, and how to configure auditing to collect it.
Select a rule on the left, or search by category, audit key, rule text, or a CIS/DISA STIG identifier, to see full detail — parsed from docs/auditd-rules-master-reference.md.

Every field name that can appear in a kernel audit record (SYSCALL, PATH, EXECVE, AVC, USER_*, and the rest) — name, value format, and what it means. auid is the one to trust for "who did this," even after su/sudo; decode hex/encoded fields with ausearch -i. Enriched with each field's nearest Splunk CIM (Common Information Model) equivalent — potential CIM name, whether that field is actually CIM-supported, which data model(s) it falls under, and which Splunk app/TA maps it out of the box vs. needing a custom FIELDALIAS/EVAL — where a mapping was known; scroll the table right to see it. "—" means no known CIM mapping; a blank cell means this field wasn't covered by the CIM enrichment pass at all.

Every value the type= field can take at the start of a record in /var/log/audit/audit.log. An event is one or more records sharing the same timestamp + serial number — the most common multi-record event is SYSCALL + PATH (×N) + CWD + EXECVE / PROCTITLE.

Numeric ranges (kernel header)

Most frequently seen in practice

The core auditd tools and their most useful options — search matches a command name, an option (e.g. -k, --start today), or a section title.

Select a command on the left to see its full option reference.

Quick operational cheat-sheet


        

        

          
Related files

          

            

          

        

      

    


    

      

        

          
          
        

      

      
Full manual pages for the auditd command family — auditctl(8), ausearch(8), aureport(8), auditd(8), augenrules(8), autrace(8), and audispd (merged into auditd since audit 3.0 — see its entry for what replaced it). Search matches a command name, a section heading, or any text inside a section.


      

        

          

          

        

        

          
Select a command on the left to read its full manual page.

        

      

    

  


  

    

    

      

        

          
          
        

      

      
The default rule files shipped with fapolicyd (/etc/fapolicyd/rules.d/), transcribed verbatim from upstream. Rules are evaluated in filename order — first subject+object match wins.


      

        

          

          

        

        

          
Select a rule on the left, or search by keyword, file type, decision, or a STIG identifier, to see full detail.

        

      

    


    

      

        

          
          
        

      

      
The subject and object attribute keywords usable on either side of a fapolicyd rule's : — from fapolicyd.rules(5). Used in shows whether a field applies to the subject (the process), the object (the file), or both.

      

        

        

          

          
        

      

    


    

      

        

          
          
        

      

      
The decision keyword that opens every rule, and the perm= values that follow it.

      

        

        

          

          
        

      


      
Object file types (ftype) seen in the shipped ruleset

      

        

      

      

    


    

      

        

          
          
        

      

      
The core fapolicyd tools and their most useful options — search matches a command name, an option, or a section title.


      

        

          

          

        

        

          
Select a command on the left to see its full option reference.

        

      


      

        

          
Quick operational cheat-sheet

          

        

        

          
Related files

          

            

          

        

      

    


    

      

        

          
          
        

      

      
Full manual pages for the fapolicyd command and config family — fapolicyd(8), fapolicyd-cli(8), fagenrules(8) (the fapolicyd counterpart of auditd's augenrules(8)), fapolicyd.conf(5), and fapolicyd.rules(5). Search matches a command name, a section heading, or any text inside a section.


      

        

          

          

        

        

          
Select a page on the left to read its full manual page.

        

      

    

  


  

    

      
      
    

    

    

      
      
The type= field of every kernel audit record — verified against
        include/uapi/linux/audit.h in the upstream Linux kernel source. This is the field
        that doubles as this catalogue's Event ID for every audit/* log.

      

    

    

      
      
Return codes from Linux-PAM's _pam_types.h — seen (as a name, not the
        raw number) in the res= field of USER_AUTH, USER_ACCT, and USER_ERR records.

      

    

    

      
      
A curated 27-capability subset (of 41 total) of the CAP_* bits from include/uapi/linux/capability.h —
        each is one bit position in the cap_pe/cap_pp/cap_pi
        hex masks of a CAPSET record (event ID 1322).

      

    

    

      
      
A curated set of the standard Linux errno.h values — seen (negated) in
        the exit= field of a failed SYSCALL record (event ID 1300).

      

    

    

      
      
The 15 SSH_DISCONNECT_* reason codes from RFC 4253 §11.1 — sshd prints
        the raw number in its "Received disconnect from ⋯" syslog line, and this catalogue uses that number as the
        Event ID for the ssh/protocol log.

      

    

    

      
      
Real MESSAGE_ID UUIDs from systemd's own catalog
        (catalog/systemd.catalog.in upstream) — the closest Linux analogue to a numeric
        Windows Event ID for anything that isn't routed through the kernel audit subsystem.

      

    

    

      
      
Technique–event associations for the events in this catalogue. Search by technique ID,
        technique name, or event ID.

      

    

    

      
      
Australian Cyber Security Centre Information Security Manual controls whose
        xccdf_org.ssgproject.content_profile_ism_o SCAP profile rules correspond to
        events in this catalogue — sourced from controls/ism_o.yml in
        ComplianceAsCode/content,
        the project behind that profile. Mapped at the subcategory level (like this catalogue's NIST 800-53
        mapping); see the README for where this catalogue's event mechanism and the profile's underlying rule
        mechanism diverge even though both serve the same control.

      

    

    

      
      
Every subcategory's config path, steps, event IDs, and NIST 800-53 AU mapping — the same data
        shown inline on each event's detail view, browsable as one table. See also
        docs/audit-configuration-guide.md.

      

    

  


  

    
Other tools by the same author — not part of this repo's own data, just useful alongside it.