---
name: "laurel2audit"
section: "8"
platform: "linux"
package: "laurel"
version: "0.7.1-1+b2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/laurel2audit"
---

# laurel2audit(8)

transform Laurel logs to back to original Linux Audit format

## NAME

[laurel2audit(8)](/laurel2audit/8.md) – transform Laurel logs to back to original Linux Audit format

## SYNOPSIS

This is a simple filter that reads logs written by `laurel(8)` and outputs Linux Audit logs that the audit tools and `laurel` itself should be able to digest.

## NOTES

“Enriched” (i.e. ALL\_CAPS) keys in audit records are discarded.

`EXECVE` records are output on one, possibly very long, line.

If `laurel` has transformed `EXECVE` argument lists to single strings (`ARGV_STR`), that transformation may have been lossy: There is no way to discern space characters as gaps between arguments from space characters as part of individual arguments.

An end-of-event (`EOE`) marker is output for every event. This marker is not part of the original `audit.log` file, but it has originally been transmitted by the kernel and is passed by `auditd(8)` to plugins.

## BUGS

- •

  URL-encoded single bytes within strings are not yet handled.

- •

  Possibly more.

## SEE ALSO

`laurel(8)`, `aulast(8)`, `aulastlog(8)`, `aureport(8)`, `ausearch(8)`, `ausyscall(8)`, `auvirt(8)`

## AUTHORS

- •

  Hilko Bengen \<⟨bengen@hilluzination.de⟩\\c \>