Re: Audit for live supervision

No, when opening the socket the to the sub deamon audisp. I couldn't convice myself how the API would work with a socket. Does it?

I read that as that we can use the netlink socket with the libaudit directly, which sort of could be exactly what we want. That would mean we wouldn't use audit user space (processes) at all, right?

> You have 4 points to get the audit stream, in order of distance from the > event generation: the audit netlink socket, auditd realtime interface, > audisp plugin interface, and the af_unix socket created by the af_unix > plugin from audispd. For higher reliability where you don't want of need > any other audit processing interfering, I would say use either of the first > 2. > The latency is getting higher with each step. For optimal performance we would listen to the netlink socket and duplicate only the code essential to process what we are interested it. For extra points and hurt, we would do it in Ada and inside the target process, really achieving the low latency. It may be the only realistic option, but it also feels like duplication of effort. We have done netlink interfaces in Ada before, but also have on our mind that it was said that the netlink interface was said (not by you) to be still in flux. Is that still true? It certainly would be nice if the audisp had some form of output that can be fed directly into libaudit parsing as it comes in. But that may be an unrealistic expectation, is it?