Fix #1 - expose comm/exe

lib/Audit/Log.pm

@@ -105,6 +105,14 @@ As such, you can build full paths like so:
     my $rows = $parser->search( type => qr/path/i, nametype=qr/delete|create|normal/i );
     my @full_paths = map { "$_->{cwd}/$_->{name}" } @$rows;
 
+=head3 Filtering by command
+
+SYSCALL records store the command which executed the call.  This is exposed as part of the parse for each child record, such as PATH or DAEMON_* records.
+Example of getting all the commands run which triggered audit events:
+
+    my $parser = Audit::Log->new(undef, 'exe')
+    my $rows = $parser->search();
+
 =cut
 
 sub search {
@@ -113,7 +121,7 @@ sub search {
     my $ret = [];
     my $in_block = 1;
     my $line = -1;
-    my $cwd = '';
+    my ($cwd, $exe, $comm) = ('','','');
     open(my $fh, '<', $self->{path});
     LINE: while (<$fh>) {
         next if index( $_, 'SYSCALL') < 0 && !$in_block;
@@ -130,6 +138,8 @@ sub search {
             my $cwd_start = index($_, 'cwd="') + 5;
             my $cwd_end   = index($_, "\n") - 1;
             $cwd = substr($_, $cwd_start, $cwd_end - $cwd_start);
+            $line++;
+            next;
         }
 
         # Replace GROUP SEPARATOR usage with simple spaces
@@ -149,9 +159,13 @@ sub search {
         $parsed{line}      = $line;
         $parsed{timestamp} = $timestamp;
         $parsed{cwd}       = $cwd;
+        $parsed{exe}       //= $exe;
+        $parsed{comm}      //= $comm;
 
         if (exists $options{key} && $parsed{type} eq 'SYSCALL') {
             $in_block = $parsed{key} =~ $options{key};
+            $exe = $parsed{exe};
+            $comm = $parsed{comm};
             $cwd = '';
             next unless $in_block;
         }

t/Audit-Log.t

@@ -8,7 +8,7 @@ use Test::Deep;
 use Audit::Log;
 use List::Util 1.45 qw{uniq};
 
-my $parser = Audit::Log->new('t/audit.log','name','type','nametype','line','timestamp', 'cwd');
+my $parser = Audit::Log->new('t/audit.log','name','type','nametype','line','timestamp', 'cwd', 'exe', 'comm');
 my $rows = $parser->search( type => qr/path/i, nametype => qr/create|delete/i, name => qr/^backups\/[^\.]/, key => qr/backupwatch/, older => 1642448670, newer => 1642441403 );
 
 my $expected = [
@@ -19,6 +19,8 @@ my $expected = [
     'nametype' => 'CREATE',
     'name' => 'backups/test.txt',
     'cwd'  => '/testpath',
+    'exe'  => '/usr/bin/touch',
+    'comm' => 'touch',
   },
   {
     'type' => 'PATH',
@@ -27,6 +29,8 @@ my $expected = [
     'name' => 'backups/testme.txt',
     'nametype' => 'DELETE',
     'cwd'      => '/testpath',
+    'exe'      => '/usr/bin/rm',
+    'comm'     => 'rm',
   }
 ];