Re: filtering out audit output
On Tuesday, February 01, 2011 02:34:23 pm Levy, Mark (IT Solutions) wrote:
Hi, I'm trying to find a way to filter out some of the excess
output from
netiq which does a df every 10 seconds. I haven't had any success yet and
was hoping someone could point me the right direction. Below is the output
that I would like to filter out.
node=newman.netiq.northgrum.com type=CWD msg=audit(02/01/2011
01:26:09.976:336030) : cwd=/usr/netiq/vsau/bin
node=newman.netiq.northgrum.com type=EXECVE msg=audit(02/01/2011
01:26:09.976:336030) : argc=(null) a0=/bin/df a1=-kP a2=../local/spool
node=newman.netiq.northgrum.com type=SYSCALL msg=audit(02/01/2011
01:26:09.976:336030) : arch=x86_64 syscall=execve per=400000 success=yes
exit=0 a0=7fffe76acc58 a1=7fffe76aa af8 a2=603c90 a3=0 items=2 ppid=3465
pid=9347 auid=unset uid=root gid=root euid=root suid=root fsuid=root
egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=df exe
=/bin/df key=(null)
----
This looks like you have an audit rule for execve. Do you have some reason to audit
execve? If not, I would place watches on the programs you care about and not capture
all execve. Or do you care about programs that users run rather than the system
running? In that case, I would restrict the execve to auid>=500 and auid!=4294967295.
If you just don't want df, near the top try this:
-a exit,never -F path=/bin/df -F perm=x
It has to be before the rule that triggers the execve because the audit system has a
first match wins rule engine. You may need a recent kernel for that to work as it did
not work as intended at first.
-Steve