October 2010 - Linux-audit - Linux-Audit List Archives

by LC Bruzenak

I know I can go look at the code, however I figured I'd ask here first about the limits on the user message in both audit_log_user_message and ausearch. With audit_log_user_message the maximum length allowed appears to be around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the executable name length (and other stuff auto-pushed into the string) which is why I say "around". Even when I get a successful return value (from audit_log_user_message), I don't get my string back out in "ausearch" unless it is WAY smaller - ~1K or less I think. Any ideas/thoughts? This is the latest (1.7.11-2) audit package. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

11 years, 1 month

5
17
0 / 0

AUDIT_SIGNAL_INFO

by Matthew Booth

Under what circumstances will the RHEL 4 kernel generate a message of type AUDIT_SIGNAL_INFO? My understanding is that it should be sent when a process sends a signal to the audit daemon, however I have not observed that. Any ideas? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

12 years, 4 months

3
4
0 / 0

Near Term Audit Road Map

by Steve Grubb

Hi, With the proposals sent to the list, I wanted to talk about how this might play out code-wise. With regard to the current code base, I am working on a 1.8 release. This would represent finishing the remote logging app and nothing more. The 1.8 series would become just an update series just like the 1.0.x series did. In parallel with finishing remote logging, I would release a 2.0 version. Patches applied to 1.8 would also be applied to 2.0. A 2.1 release would signify the completion of remote logging that branch. I would recommend this branch for all distributions pulling new code in. The 2.0 branch will also have a couple more changes. I want to split up the audit source code a little bit. I want to drop the system-config-audit code and let it become standalone package updated and distributed separately. I also want to drop all audispd-plugins in the 2.0 branch and have them released separately. They cause unnecessary build dependencies for the audit package. During the work for a 2.2 release, I would also like to pull the audispd program inside auditd. In the past, I tried to keep auditd lean and single purpose, but with adding remote logging and kerberos support, we already have something that is hard to analyze. So, to improve performance and decrease system load, the audit daemon will also do event dispatching. Would this proposal impact anyone in a Bad Way? Thanks, -Steve

12 years, 4 months

4
11
0 / 0

missing user authentication events.

by Robert Harris

12 years, 11 months

3
5
0 / 0

Has anyone else seen memory Problems with audisp-remote?

by Jim Richard

All: I've seen the following situation occur on 2 machines now for a total of 3 incidents: * Audisp-remote runs normally on 5 separate servers, the problem happens on two that are configured the same as the other 3. * Audisp-remote runs normally on the problem servers for days to weeks at a time without problems. * For an unidentified reason (nothing that I can find in any system log) audisp-remote stops sending messages to the central log server. * Some hours or days later (depending on audit event activity) audisp-remote consumes all system memory and swap space. In my case because of the nature of my directory tree watches for my web content this usually happens when the web content is being regenerated from scratch by our build server. The memory consumption happens very rapidly. * One server is configured with 8GB of ram and 2GB of swap, the second server has 12GB of ram and 2GB of swap. * The system becomes completely unresponsive until enough time goes by for some critical need for memory to arise and the OOM Killer kicks in and starts reaping enough tasks to allow me to get in and shutdown auditd. * At this point the system returns to normal, and if I restart auditd it resumes normal operation. Here is a ps aux taken when it happened today on the 12GB machine: USER PID %CPU %MEM VSZ RSS T TY STAT START TIME COMMAND root 1106 0.0 0.0 0 0 ? S< Oct12 0:36 [kauditd] root 4768 0.1 0.0 92880 500 ? S<sl Oct17 26:22 auditd root 4770 0.2 0.1 212984 12984 ? S<sl Oct17 31:49 /sbin/audispd root 4771 0.0 96.7 28631936 11899072 ? S< Oct17 7:52 /sbin/audisp-remote Priorities for each audit task are: Auditd -4 Audispd -14 Audisp-remote -4 All machines are fully current on maintenance. Running RedHat EL 5.5 x86_64 with the following audit package set: * audit-libs-python-1.7.17-3.el5 * audit-libs-1.7.17-3.el5 * audit-libs-1.7.17-3.el5 * audit-1.7.17-3.el5 * audispd-plugins-1.7.17-3.el5 All that being said, I have the following questions: * Has anyone seen this, and if so what workarounds, or fixes are available. * What additional data should I collect that may assist in identifying the root cause of the problem? Since it can take days for this to manifest itself it seems like traces are out of the question, but perhaps there are other collection tools that can be used. * Are there any program options or configuration options that can be used to debug this? The man pages seem to be a bit stale in this distribution? * Does anyone have any other ideas on what I might do to get to the bottom of this? I also have a separate issue, that I'm curious about. Under RedHat EL 5.5 there doesn't seem to be any limitations on the support for audisp-remote, but I just noticed in the release notes for RedHat EL 6 Beta, this component is flagged as a Technology Preview in EL 6. Does anyone know the reason for the change in status? I was planning to use this as part of my PCI-DSS compliance efforts next year but this change may make that choice problematic. Attached please find my current auditd.conf, audispd.conf, audisp-remote.conf and au-remote.conf files. Beyond this query I also plan to open a support incident with RedHat, but I thought that by using feedback from this group I might be in a better position to provide support with useful information to aid in problem diagnosis. Please let me know anything else that may help to get to the bottom of this. Thanks in advance! Jim

13 years, 12 months

2
1
0 / 0

ausearch

by Pittigher, Raymond - CS

I see that the -w or --word switch was added to the ausearch but how it it used? The man pages claim: String based matches must match the whole word. But I have been trying ausearch -w failed and variation of that but only get the message ausearch -if audit.log.3 -w failed failed is an unsupported option This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

14 years

3
2
0 / 0

Confused about audit=1 in grub.conf

by Robert Evans

14 years

3
3
0 / 0

Which auditd for which kernel?

by Karl Katzke

We¹re on another linux distro, where 2.6.26 is the name of the game, and the changelog for auditd doesn¹t seem to specify what the required version of the kernel is for which version of auditd. What¹s the appropriate response? Step back to the 1.x arch of autid, although I note that the redhat build is 1.7.18 and the changelog doesn¹t seem to have been updated since 1.7.13? Thanks, Karl Katzke

14 years

2
2
0 / 0

AUTO: Matt Weale/UK/CSC is out of the office. (returning 01/11/2010)

by Matt Weale

I am out of the office until 01/11/2010. For any GBS related issues then please contact Tim Challender. For any Olympus related issues then please contact Les Klein. Many thanks. Note: This is an automated response to your message "Linux-audit Digest, Vol 73, Issue 11" sent on 25/10/10 17:00:07. This is the only notification you will receive while this person is away.

14 years

1
0
0 / 0

Wish List...

by Jim Richard

All: So here's one for the wish list... It would be exceedingly nice to have "not logic" in ausearch. So here's my problem, I have a ton of file watches for my Web Application content. I have one account that loads content. So I'd like to generate a report of any user other than the account that is authorized to load the content. So what I'd like is something like: ausearch -i -ua ! ContentAccount I'm not particularly in love with the syntax above but anything that provides this functionality would be incredibly useful, especially if it was generalized to all options, and could be intermixed with positive tests as "Ands, or Ors"... But just the "Not" would be incredibly helpful. Any thoughts? Regards, Jim

14 years

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit October 2010