December 2009 - Linux-audit - Linux-Audit List Archives

by LC Bruzenak

I know I can go look at the code, however I figured I'd ask here first about the limits on the user message in both audit_log_user_message and ausearch. With audit_log_user_message the maximum length allowed appears to be around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the executable name length (and other stuff auto-pushed into the string) which is why I say "around". Even when I get a successful return value (from audit_log_user_message), I don't get my string back out in "ausearch" unless it is WAY smaller - ~1K or less I think. Any ideas/thoughts? This is the latest (1.7.11-2) audit package. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

11 years, 8 months

5
17
0 / 0

AUDIT_SIGNAL_INFO

by Matthew Booth

Under what circumstances will the RHEL 4 kernel generate a message of type AUDIT_SIGNAL_INFO? My understanding is that it should be sent when a process sends a signal to the audit daemon, however I have not observed that. Any ideas? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

13 years

3
4
0 / 0

Near Term Audit Road Map

by Steve Grubb

Hi, With the proposals sent to the list, I wanted to talk about how this might play out code-wise. With regard to the current code base, I am working on a 1.8 release. This would represent finishing the remote logging app and nothing more. The 1.8 series would become just an update series just like the 1.0.x series did. In parallel with finishing remote logging, I would release a 2.0 version. Patches applied to 1.8 would also be applied to 2.0. A 2.1 release would signify the completion of remote logging that branch. I would recommend this branch for all distributions pulling new code in. The 2.0 branch will also have a couple more changes. I want to split up the audit source code a little bit. I want to drop the system-config-audit code and let it become standalone package updated and distributed separately. I also want to drop all audispd-plugins in the 2.0 branch and have them released separately. They cause unnecessary build dependencies for the audit package. During the work for a 2.2 release, I would also like to pull the audispd program inside auditd. In the past, I tried to keep auditd lean and single purpose, but with adding remote logging and kerberos support, we already have something that is hard to analyze. So, to improve performance and decrease system load, the audit daemon will also do event dispatching. Would this proposal impact anyone in a Bad Way? Thanks, -Steve

13 years

4
11
0 / 0

ausearch

by Pittigher, Raymond - CS

I see that the -w or --word switch was added to the ausearch but how it it used? The man pages claim: String based matches must match the whole word. But I have been trying ausearch -w failed and variation of that but only get the message ausearch -if audit.log.3 -w failed failed is an unsupported option This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

14 years, 7 months

3
2
0 / 0

How to learn the Message type?

by 陈洁丹

Hello, my friends. Every record contains a type field.It's about the message type such as AUDIT_AVC, AUDIT_SYSCALL and so on. Does AVC mean Mandatory Access Control ? Is all the messag types listed in msg_typetab.h? What do they mean exactly? Where can I get the information about them ? I look into the _LIBAUDIT_H_ , and find this sentence * 1300 - 1399 audit event messages But in this file , I find nothing about audit event message Can anyone give me an URL or give a book for me about the audit event message? Thanks a lot ^_^ Jeedan -- ----------------------------- 陈洁丹北京邮电大学软件学院地址：北京邮电大学学二D12寝室邮编： 100876 Email: jeedan.chen(a)gmail.com ---------------------------------

15 years, 4 months

3
6
0 / 0

The plugin didnot work

by 陈洁丹

Hello every one. My plugin now works well in the debug mode,I.E. using *cat log | ./audisp-example* it works well But it failed when I did not use the debug mode. Here it's the code that I have changed. /* This function shows how to dump a whole record's text */ static void dump_whole_record(auparse_state_t *au) { FILE *out; if((out=fopen("./test.txt","a+"))!=NULL)/*打开源文件，读取数据*/ { fprintf(out,"%s: %s\n", audit_msg_type_to_name(auparse_get_type(au)),auparse_get_record_text(au)); fclose(in); /*关文件*/ } // printf("%s: %s\n", audit_msg_type_to_name(auparse_get_type(au)),auparse_get_record_text(au)); //printf("\n"); } In the debug mode I'm able to create a test.txt in the current direcory .And write the information into the test.txt But when I copy the audisp-example to /sbin/, and copy the configure file audisp-example.conf to /etc//etc/audisp/plugins.d restart the auditd, it didnot work. Why? Can anyone help Regards Jeedan -- ----------------------------- 陈洁丹北京邮电大学软件学院地址：北京邮电大学学二D12寝室邮编： 100876 Email: jeedan.chen(a)gmail.com --------------------------------- -- ----------------------------- 陈洁丹北京邮电大学软件学院地址：北京邮电大学学二D12寝室邮编： 100876 Email: jeedan.chen(a)gmail.com ---------------------------------

15 years, 5 months

2
1
0 / 0

aureport question

by LC Bruzenak

Steve, The aureport utility has an option to use an alternative input file. Because I have to move my logs, I really need an alternative input directory, preferably a starting point, since my saved logs are: /var/log/audit-archive/<YEAR>/<MONTH>/<DAY> . Then I could do "aureport --topdir /var/log/audit-archive/2009/12 " and get all the 12/2009 events up to now. What do you think? I thought about creating a different flat directory and just linking the files I want, however I do not think the current options will allow this either. I guess that would be the easiest change though, to allow the -if parameter to be a directory or a file. Thx, LCB. -- LC (Lenny) Bruzenak

15 years, 5 months

2
1
0 / 0

Add a plugin

by Adan

Hello everyone, I want to add a plugin. I now konw how to debug with the command * ausearch --start today --raw > test.log. * * Then you can test this app by: cat test.log | ./audisp-example Right now , I want to add it to the audit project to make it response to the event at the same time. What should I do? I really need your help,since I donot know how it pass a record to the plugin. ------------------ 祝身体健康，工作愉快！陈洁丹 ----------------------------- 陈洁丹北京邮电大学软件学院地址：北京邮电大学学二D12寝室邮编： 100876 Email: buptsse(a)qq.com ---------------------------------

15 years, 5 months

2
1
0 / 0

Filter for audit.log

by corbin＠arlut.utexas.edu

Hello, we have installed Splunk in order to monitor the audit.log files of several systems. However, our audit.log files are turning over quicker than usual since Splunk seems to span our audit.log file with entries. Is there a way to get audit.log to filter messages from Splunk in RHEL 5 server systems? Thanks in advance! Starr

15 years, 5 months

2
1
0 / 0

How to add a plugin

by Adan

Hello,everyone. Firstly, I want to thanks Steve.With his help I finally install the audit-1.7.17. I'm a fresh man in linux and audit . I have install the audit, but under /etc/audisp/plugins.d I only find two plugins.I want to add another plugin. For example the audisp-example.c audisp-example.conf, what should I do ? After compiling the audisp-example.c I get audisp-example ,but when should I put it? Should I put the audisp-example.conf under the directory of /etc/audisp/plugins.d ? Anything else? Thanks~~~ Jeedan

15 years, 5 months

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit December 2009