10:23 p.m.
Hi,
Turning on all system calls in audit.rules, and transferring a tar file to the target
system (CentOS 7, 4 cores), I found "auditd" consumes high CPU usage.
Is it expected?
BTW, after turning write-logs off, and add dispatcher, both "audispd" and
"auditd" are consuming high CPU.
Regards
Hai
7:14 a.m.
Hello,
On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
Turning on all system calls in audit.rules, and transferring a tar
file to
the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU
usage. Is it expected?
It would not be surprising. Some system calls have more overhead than others.
So, depending on everything that is running, you can kill your system.
BTW, after turning write-logs off, and add dispatcher, both
"audispd" and
"auditd" are consuming high CPU.
They have a lot of events to handle.
-Steve
5:21 a.m.
Hi Steve,
I ever read the document you wrote about laying IDS on top of auditd. And I suppose
inotify could be lightweight for IDS. Any comment?
Best regards
Hai
------------------ Original ------------------
From: "Steve Grubb"<sgrubb(a)redhat.com>;
Date: Fri, Jul 12, 2019 08:14 PM
To: "linux-audit"<linux-audit(a)redhat.com>;
Cc: "杨海"<hai.yang(a)magic-shield.com>;
Subject: Re: overhead of auditd
Hello,
On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
Turning on all system calls in audit.rules, and transferring a tar
file to
the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU
usage. Is it expected?
It would not be surprising. Some system calls have more overhead than others.
So, depending on everything that is running, you can kill your system.
BTW, after turning write-logs off, and add dispatcher, both
"audispd" and
"auditd" are consuming high CPU.
They have a lot of events to handle.
-Steve
7:29 a.m.
You can enable the syscalls that you think will be helpful from an IDS
perspective.
There are also other downstream tools like goaudit and OSS kernel modules
like sysdig falco (not related to auditd) which may be able to simplify
things for you.
Farhan
On Mon, Jul 15, 2019 at 6:25 AM 杨海 <hai.yang(a)magic-shield.com> wrote:
Hi Steve,
I ever read the document you wrote about laying IDS on top of auditd. And
I suppose inotify could be lightweight for IDS. Any comment?
Best regards
Hai
------------------ Original ------------------
*From: * "Steve Grubb"<sgrubb(a)redhat.com>;
*Date: * Fri, Jul 12, 2019 08:14 PM
*To: * "linux-audit"<linux-audit(a)redhat.com>;
*Cc: * "杨海"<hai.yang(a)magic-shield.com>;
*Subject: * Re: overhead of auditd
Hello,
On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
> Turning on all system calls in audit.rules, and transferring a tar file
to
> the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU
> usage. Is it expected?
It would not be surprising. Some system calls have more overhead than
others.
So, depending on everything that is running, you can kill your system.
> BTW, after turning write-logs off, and add dispatcher, both "audispd" and
> "auditd" are consuming high CPU.
They have a lot of events to handle.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
9:56 a.m.
On Monday, July 15, 2019 6:21:11 AM EDT 杨海 wrote:
I ever read the document you wrote about laying IDS on top of auditd.
And I
suppose inotify could be lightweight for IDS. Any comment?
Yes, audit works fine for IDS work. But one would not audit all syscalls for
every program. That will kill your system. You have to be selective about
what you are auditing.
-Steve
------------------ Original ------------------
From: "Steve Grubb"<sgrubb(a)redhat.com>;
Date: Fri, Jul 12, 2019 08:14 PM
To: "linux-audit"<linux-audit(a)redhat.com>;
Cc: "杨海"<hai.yang(a)magic-shield.com>;
Subject: Re: overhead of auditd
Hello,
On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
> Turning on all system calls in audit.rules, and transferring a tar file
> to the target system (CentOS 7, 4 cores), I found "auditd" consumes
> high CPU usage. Is it expected?
It would not be surprising. Some system calls have more overhead than
others. So, depending on everything that is running, you can kill your
system.
> BTW, after turning write-logs off, and add dispatcher, both "audispd"
> and "auditd" are consuming high CPU.
They have a lot of events to handle.
1986
days inactive
1989
days old
linux-audit@lists.linux-audit.osci.io
4 comments
3 participants
participants (3)
-
F Rafi -
Steve Grubb -
杨海