Re: ausearch question

On Monday, April 07, 2014 04:29:34 PM Burn Alting wrote: > All, > > I note when interpreting raw audit with the ausearch --interpret option, > the code in src/ausearch-report.c:output_interpreted_node(), when > parsing key value pairs which are not enclosed in double or single > quotes, looks for embedded comma's in the value part and, if found, > effectively terminates the value at the comma. This in effect, makes the > data after the comma the start of the next key (if any). There are some > exceptions in the code (audit_type == AUDIT_VIRT_MACHINE_ID, > AUDIT_OBJ_PID, AUDIT_PATH and AUDIT_IPC). I presume we are talking about this area of code: https://fedorahosted.org/audit/browser/trunk/src/ausearch-report.c#L276

> What sort of input is this addressing? The audit system has migrated its events slowly over time. The current code base can read/search/report/interpret audit events all the way back to about the 2004 time frame. So, sometimes you find things that are left over from long ago. But you might need this legacy support if the tools are on an aggregating server.

> Are there examples? type=USER_ACCT msg=audit(1223987805.696:8): user pid=4885 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct="sgrubb" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)' Up until around 2010, all user space originating events had commas between the last 4 fields which also including being inside parenthesis. This was later decided to be a waste of bytes and slowed down parsing to handle the comma for matching/translating purposes. Current events do not have this.

If you see any current events that are mishandled by this legacy code, let me know and I'll see how we can fix it.

-Steve