Re: Config_change events
On Monday, December 30, 2019 12:21:15 PM EST MAUPERTUIS, PHILIPPE wrote:
When I issue a service auditd restart, I get the following events :
[root@xxxxxxxx ~]# ausearch -k 10.5.5-modification-audit -ts recent
--format raw node=xxxxxxxx type=CONFIG_CHANGE
msg=audit(1577725960.912:8745): auid=4294967295 ses=4294967295
op=remove_rule key="10.5.5-modification-audit" list=4
res=1AUID="unset"
node=xxxxxxxx type=CONFIG_CHANGE msg=audit(1577725960.947:8777):
auid=4294967295 ses=4294967295 op=add_rule key="10.5.5-modification-audit"
list=4 res=1AUID="unset"
How can I link this event to the daemon_start daemon_end events ?
The best way is by a time window. Did it occur within a second of the audit
daemon starting or stopping?
How can I trace the CONFIG_CHANGE events to a user action ?
You would have to place a watch on auditctl. In this particular case, auid
and session are -1, which means a daemon did it.
Are the Daemon_start and daemon_end events specifically linked to
auditd ?
Yes.
-Steve