Re: Troubleshooting Custom audispd Plugin

Hi, I'm working on a custom audispd plugin written in Python 3. It’s a work

progress and I’ve successfully run it numerous times as an audispd

However, I sometimes make modifications that result in the audispd plugin failing and I end up with the following in /var/log/syslog Sep 6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3 terminated unexpectedly Sep 6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3 was restarted ... This is repeated several times until audispd gives up and I see the following message: Sep 6 20:52:14 ubuntu-hypervisor audispd: plugin /usr/bin/python3 has exceeded max_restarts To troubleshoot, I modify my code to read from /var/log/audit/audit.log instead. I modify a single line (with fileinput.input() to read from myfile as shown in the commented line below). Here is the code snippet (a colorized easier to read version is available here - https://pastebin.com/84Nxu3Rp): # let us initialize the AuParser aup = auparse.AuParser(auparse.AUSOURCE_FEED) # we initalize the callback to be fn_process_event aup.add_callback(fn_process_event, None, None) myfile = "/var/log/audit/audit.log" while True: try: # we read in line by line from stdin for line in fileinput.input(): #for line in fileinput.input(myfile): aup.feed(line) except: logger.error("Fatal error in while loop", exc_info=True) # we flush the feed when we quit aup.flush_feed() Any suggestions on how to troubleshoot these types of issues when reading from a file works fine without issue but running it as a plugin fails as shown in /var/log/syslog? Thanks.