On Tue, 2021-01-26 at 11:29 +1100, Burn Alting wrote:

On Mon, 2021-01-25 at 19:20 -0500, Steve Grubb wrote:

On Monday, January 25, 2021 7:11:45 PM EST Burn Alting wrote:

On Mon, 2021-01-25 at 18:53 -0500, Steve Grubb wrote:

On Saturday, January 23, 2021 5:55:44 PM EST Burn Alting wrote:

How is the following for a way forward.

a. I will author a patch to the user space code to correctly parse

this

condition and submit it on the weekend. It will be via a new

configuration item to auditd.conf just in case placing a fixed

extended timeout (15-20 secs) affects memory usage for users of the

auparse library. This solves the initial problem of

ausearch/auparse

failing to parse generated audit.b. I am happy to instrument what

ever

is recommended on my hosts at home (vm's and bare metal) to provide

more information, should we want to 'explain' the occurrence, given

see this every week or two and report back.

Seems reasonable to me.

I can implement the 'end_of_event_timeout' change either as

i. a command line argument to ausearch/aureport (say --eoetmo secs) and

new pair of library functions within the  auparse() stable (say

auparse_set_eoe_timeout() and auparse_get_eoe_timeout())

or

ii. a configuration item in /etc/audit/auditd.conf, or

Which is your preference? Mine is i. as this is a user space processing

change, not a demon change.

To be honest, I'm not entirely sure what we're seeing. I run some tests

today on my system. It's seeing issues also. I'd still like to treat the

root cause of this. But we do need to change the default. That I what

I'm trying to figure out.

Back to your question, I'm wondering if we should do both? A changeable

default in auditd.conf and an override on the command line.

So far, all items in /etc/audit/auditd.conf appear to only affect the

daemon. Is this the right location to start adding non-daemon

configuration items? (I accept there is no other place).

ausearch/report/auparse all read the auditd.conf to find the canonical

location for where the logs are supposed to be. So, they already read this

file. I'd rather keep it there than make yet another config. The only drawback

it that it might again confuse people that auditd really doesn't do anything

with the records but just some light processing.

OK. I will put it in /etc/audit/auditd.conf

One question with this solution. If the user does not have read permission to /etc/audit/auditd.conf, then any change cannot take effect. The default mode for this file is 640 to root, so a non-root user could never change the timeout.

Should I also add

- a command line argument to ausearch/aureport (say --eoetmo secs) and,

- a pair of new auparse() functions - auparse_set_eoe_timeout() and auparse_get_eoe_timeout()

so that non root users can make use of the new configuration item.

Also, do you want the default timeout to be 2 seconds or should I make it higher.