Re: Occasional delayed output of events

On Mon, 2021-01-25 at 19:20 -0500, Steve Grubb wrote: > On Monday, January 25, 2021 7:11:45 PM EST Burn Alting wrote: > > On Mon, 2021-01-25 at 18:53 -0500, Steve Grubb wrote: > > > On Saturday, January 23, 2021 5:55:44 PM EST Burn Alting wrote: > > > > > > How is the following for a way forward.a. I will author a patch to the > > > > > > user space code to correctly parsethiscondition and submit it on the > > > > > > weekend. It will be via a newconfiguration item to auditd.conf just in > > > > > > case placing a fixedextended timeout (15-20 secs) affects memory usage > > > > > > for users of theauparse library. This solves the initial problem > > > > > > ofausearch/auparsefailing to parse generated audit.b. I am happy to > > > > > > instrument whateveris recommended on my hosts at home (vm's and bare > > > > > > metal) to providemore information, should we want to 'explain' the > > > > > > occurrence, givenIsee this every week or two and report back. > > > > > > > > > > Seems reasonable to me. > > > > > > > > I can implement the 'end_of_event_timeout' change either asi. a command > > > > line argument to ausearch/aureport (say --eoetmo secs) andanew pair of > > > > library functions within the auparse() stable > > > > (sayauparse_set_eoe_timeout() and auparse_get_eoe_timeout())orii. a > > > > configuration item in /etc/audit/auditd.conf, or > > > > > > > > Which is your preference? Mine is i. as this is a user space > > > > processingchange, not a demon change. > > > > > > To be honest, I'm not entirely sure what we're seeing. I run some teststoday > > > on my system. It's seeing issues also. I'd still like to treat theroot cause > > > of this. But we do need to change the default. That I whatI'm trying to > > > figure out. > > > Back to your question, I'm wondering if we should do both? A > > > changeabledefault in auditd.conf and an override on the command line. > > > > So far, all items in /etc/audit/auditd.conf appear to only affect thedaemon. > > Is this the right location to start adding non-daemonconfiguration items? (I > > accept there is no other place). > > ausearch/report/auparse all read the auditd.conf to find the canonical location > for where the logs are supposed to be. So, they already read this file. I'd > rather keep it there than make yet another config. The only drawback it that it > might again confuse people that auditd really doesn't do anything with the > records but just some light processing. OK. I will put it in /etc/audit/auditd.conf