5:06 p.m.
Hello,
I configured space_left and space_left_action to run a script that
compresses and moves older audit log files from /var/log/audit. It
appears to work 1 time, and then doesn't work anymore until I kill the
auditd daemon and start it again.
Is this expected and/or desired behavior? I didn't see anything in the
man pages about this behavior. I was hoping to have my script run every
time the space_left threshold is hit so as to not run out of logging
disk space. Is there something I can do to accomplish this?
Thanks,
Bond
12:22 a.m.
Hello,
On Wed, 25 Jan 2017 15:06:50 -0800
Bond Masuda <bond.masuda(a)jlbond.com> wrote:
I configured space_left and space_left_action to run a script that
compresses and moves older audit log files from /var/log/audit. It
appears to work 1 time, and then doesn't work anymore until I kill
the auditd daemon and start it again.
Is this expected and/or desired behavior? I didn't see anything in
the man pages about this behavior. I was hoping to have my script run
every time the space_left threshold is hit so as to not run out of
logging disk space. Is there something I can do to accomplish this?
You may need to send SIGUSR2 to `pidof auditd` to reset the internal
counters. Let me know if that does not fix it.
-Steve
1:38 p.m.
Thanks Steve for the suggestion. Unfortunately, even with my script
sending USR2 to auditd, i still get the same behavior where the
space_left_action=exec call to the script only happens once.
Thoughts?
Bond
On 01/25/2017 10:22 PM, Steve Grubb wrote:
Hello,
On Wed, 25 Jan 2017 15:06:50 -0800
Bond Masuda <bond.masuda(a)jlbond.com> wrote:
> I configured space_left and space_left_action to run a script that
> compresses and moves older audit log files from /var/log/audit. It
> appears to work 1 time, and then doesn't work anymore until I kill
> the auditd daemon and start it again.
>
> Is this expected and/or desired behavior? I didn't see anything in
> the man pages about this behavior. I was hoping to have my script run
> every time the space_left threshold is hit so as to not run out of
> logging disk space. Is there something I can do to accomplish this?
You may need to send SIGUSR2 to `pidof auditd` to reset the internal
counters. Let me know if that does not fix it.
-Steve
2:08 p.m.
My thought: If Steve is able to help you fix the behavior, then great.
Otherwise, pivot.
Instead of using the space_left_action in auditd, use logrotate and have it
check for max log size. Put your script in the postrotate section if more
logic than what is provided with logrotate is needed.
Stephen
On Thu, Jan 26, 2017 at 2:41 PM Bond Masuda <bond.masuda(a)jlbond.com> wrote:
Thanks Steve for the suggestion. Unfortunately, even with my script
sending USR2 to auditd, i still get the same behavior where the
space_left_action=exec call to the script only happens once.
Thoughts?
Bond
On 01/25/2017 10:22 PM, Steve Grubb wrote:
> Hello,
>
> On Wed, 25 Jan 2017 15:06:50 -0800
> Bond Masuda <bond.masuda(a)jlbond.com> wrote:
>> I configured space_left and space_left_action to run a script that
>> compresses and moves older audit log files from /var/log/audit. It
>> appears to work 1 time, and then doesn't work anymore until I kill
>> the auditd daemon and start it again.
>>
>> Is this expected and/or desired behavior? I didn't see anything in
>> the man pages about this behavior. I was hoping to have my script run
>> every time the space_left threshold is hit so as to not run out of
>> logging disk space. Is there something I can do to accomplish this?
> You may need to send SIGUSR2 to `pidof auditd` to reset the internal
> counters. Let me know if that does not fix it.
>
> -Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
2:14 p.m.
Thanks for the alternative Stephen. Actually, I already have one that
seems to work by using incrond to monitor for new log files in
/var/log/audit and running my script when a new log file appears. My
script searches for uncompressed logs that end in a audit.log.* and
compresses those and moves them. I have auditd set to keep_logs at 64MB
each. This seems to work in terms of keeping the /var/log/audit
partition space from filling up too much when we get lots of audit logs.
I plan to use this method unless the native auditd mechanism can be made
to work for this use case.
Bond
On 01/26/2017 12:08 PM, Stephen Buchanan wrote:
My thought: If Steve is able to help you fix the behavior, then
great.
Otherwise, pivot.
Instead of using the space_left_action in auditd, use logrotate and
have it check for max log size. Put your script in the postrotate
section if more logic than what is provided with logrotate is needed.
Stephen
On Thu, Jan 26, 2017 at 2:41 PM Bond Masuda <bond.masuda(a)jlbond.com
<mailto:bond.masuda@jlbond.com>> wrote:
Thanks Steve for the suggestion. Unfortunately, even with my script
sending USR2 to auditd, i still get the same behavior where the
space_left_action=exec call to the script only happens once.
Thoughts?
Bond
On 01/25/2017 10:22 PM, Steve Grubb wrote:
> Hello,
>
> On Wed, 25 Jan 2017 15:06:50 -0800
> Bond Masuda <bond.masuda(a)jlbond.com
<mailto:bond.masuda@jlbond.com>> wrote:
>> I configured space_left and space_left_action to run a script that
>> compresses and moves older audit log files from /var/log/audit. It
>> appears to work 1 time, and then doesn't work anymore until I kill
>> the auditd daemon and start it again.
>>
>> Is this expected and/or desired behavior? I didn't see anything in
>> the man pages about this behavior. I was hoping to have my
script run
>> every time the space_left threshold is hit so as to not run out of
>> logging disk space. Is there something I can do to accomplish this?
> You may need to send SIGUSR2 to `pidof auditd` to reset the internal
> counters. Let me know if that does not fix it.
>
> -Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com <mailto:Linux-audit@redhat.com>
https://www.redhat.com/mailman/listinfo/linux-audit
9:31 p.m.
On Thursday, January 26, 2017 1:22:10 AM EDT Steve Grubb wrote:
Hello,
On Wed, 25 Jan 2017 15:06:50 -0800
Bond Masuda <bond.masuda(a)jlbond.com> wrote:
> I configured space_left and space_left_action to run a script that
> compresses and moves older audit log files from /var/log/audit. It
> appears to work 1 time, and then doesn't work anymore until I kill
> the auditd daemon and start it again.
>
> Is this expected and/or desired behavior? I didn't see anything in
> the man pages about this behavior. I was hoping to have my script run
> every time the space_left threshold is hit so as to not run out of
> logging disk space. Is there something I can do to accomplish this?
You may need to send SIGUSR2 to `pidof auditd` to reset the internal
counters. Let me know if that does not fix it.
I dug into this in detail today. I apologize for how long it took, but our QE
guy showed me how to reproduce this without losing a couple years of audit
logs I use for testing and research.
In any event, your script must send sigusr2 to the audit daemon the man page
documents this by saying to use "service auditd resume". SE Linux denies this
by default. So, you might have an AVC. I'll open a bz against selinux policy
to ask for allowance on this.
But I did find one issue. When there is an exec action, auditd really should
close its logging descriptor so that it's not writing to a deleted file. Then
on SIGUSR2, it should re-open the descriptor. This was pushed into git today.
So, the next release, which is tomorrow, will have a fix so that if your script
sends SIGUSR2, auditd should behave in a more supportive way.
Please test again once you have 2.7.4 and let me know if you have any
problems.
-Steve
2825
days inactive
2887
days old
linux-audit@lists.linux-audit.osci.io
5 comments
3 participants
participants (3)
-
Bond Masuda -
Stephen Buchanan -
Steve Grubb