Incidentally, I created a chart that shows how each record type is alike and different from every other record. You might call it a record grammar tree: http://people.redhat.com/sgrubb/audit/record-fields.html

On Tuesday, January 17, 2017 9:24:46 AM EST Paul Moore wrote: > On Tue, Jan 17, 2017 at 9:07 AM, Steve Grubb <sgrubb(a)redhat.com&gt; wrote: > > Incidentally, I created a > > chart that shows how each record type is alike and different from every > > other record. You might call it a record grammar tree: > > > > http://people.redhat.com/sgrubb/audit/record-fields.html > > This seems like something that should live in the documentation repo. > > * https://github.com/linux-audit/audit-documentation Its got a log of javascript in it. Its probably not suitable for a text based system.

I'll be starting a blog real soon now to teach people how to create this and other audit reports and visualizations. Its literally 6 lines of code to create this.

On 2017-01-17 09:07, Steve Grubb wrote: > Hell Richard, > > While we're in the NETFILTER area, the CFG event is lacking some fields, too. > Its currently: > > table,family,entries > > its missing everything about *who* sent it: > pid,uid,auid,ses,subj,exe,res > > I'd suggest: > > pid,uid,auid,ses,subj,table,family,entries,exe,res > > to make it compatible with the majority of records. Ok, I've created an issue to track this: https://github.com/linux-audit/audit-kernel/issues/35

> Incidentally, I created a > chart that shows how each record type is alike and different from every other > record. You might call it a record grammar tree: > > http://people.redhat.com/sgrubb/audit/record-fields.html > > I'd like to align as many events as possible to pid,uid,auid section of the > graph. > > -Steve - RGB

On Thursday, January 19, 2017 5:10:44 AM EST Richard Guy Briggs wrote: > On 2017-01-17 10:42, Richard Guy Briggs wrote: > > On 2017-01-17 09:07, Steve Grubb wrote: > > > Hell Richard, > > > > > > While we're in the NETFILTER area, the CFG event is lacking some fields, > > > too. Its currently: > > > > > > table,family,entries > > > > > > its missing everything about *who* sent it: > > > pid,uid,auid,ses,subj,exe,res > > > > > > I'd suggest: > > > > > > pid,uid,auid,ses,subj,table,family,entries,exe,res > > > > > > to make it compatible with the majority of records. > > > > Ok, I've created an issue to track this: > > https://github.com/linux-audit/audit-kernel/issues/35 > > And I've just closed it since the associated SYSCALL setsockopt record > lists all that information. AUDIT_NETFILTER_CFG sometimes comes out of the kernel with no syscall record. Try this, ausearch --start today -m netfilter_cfg | less You should see at least one that has no syscall record. This begs the question of why there is even a SYSCALL record? AUDIT_NETFILTER_CFG is not extra information that is gathered to help explain what the syscall means. Its a change to system configuration in its own right. It should not be attached to a syscall record - especially if its not consistent. It should be complete and stand on its own.

Thanks, -Steve > > > Incidentally, I created a > > > chart that shows how each record type is alike and different from every > > > other record. You might call it a record grammar tree: > > > > > > http://people.redhat.com/sgrubb/audit/record-fields.html > > > > > > I'd like to align as many events as possible to pid,uid,auid section of > > > the > > > graph. > > > > > > -Steve > > > > - RGB > > - RGB > > -- > Richard Guy Briggs <rgb(a)redhat.com&gt; > Kernel Security Engineering, Base Operating Systems, Red Hat > Remote, Ottawa, Canada > Voice: +1.647.777.2635, Internal: (81) 32635