On Friday, September 7, 2018 7:30:09 AM EDT Osama Elnaggar wrote:
> Hi,
>
> I'm working on a custom audispd plugin written in Python 3. It’s a work in
> progress and I’ve successfully run it numerous times as an audispd plugin.
> However, I sometimes make modifications that result in the audispd plugin
> failing and I end up with the following in /var/log/syslog
>
> Sep 6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3
> terminated unexpectedly
> Sep 6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3 was
> restarted
> ...
>
> This is repeated several times until audispd gives up and I see the
> following message:
>
> Sep 6 20:52:14 ubuntu-hypervisor audispd: plugin /usr/bin/python3 has
> exceeded max_restarts
>
> To troubleshoot, I modify my code to read from /var/log/audit/audit.log
> instead. I modify a single line (with fileinput.input() to read from
> myfile as shown in the commented line below).
>
> Here is the code snippet (a colorized easier to read version is available
> here - https://pastebin.com/84Nxu3Rp):
>
> # let us initialize the AuParser
> aup = auparse.AuParser(auparse.AUSOURCE_FEED)
>
> # we initalize the callback to be fn_process_event
> aup.add_callback(fn_process_event, None, None)
>
> myfile = "/var/log/audit/audit.log"
>
> while True:
> try:
> # we read in line by line from stdin
> for line in fileinput.input():
> #for line in fileinput.input(myfile):
> aup.feed(line)
> except:
> logger.error("Fatal error in while loop", exc_info=True)
>
> # we flush the feed when we quit
> aup.flush_feed()
>
> Any suggestions on how to troubleshoot these types of issues when reading
> from a file works fine without issue but running it as a plugin fails as
> shown in /var/log/syslog? Thanks.

All plugins have a requirement to take events from stdin. As long as it
expects strings (which is the way that auparse wants them), then all you have
to do is:

ausearch --start boot --raw | ./plugin

You can also save raw logs with ausearch and cat them into the plugin. This
is helpful when you get a problem down to a certain series of events and you
don't want to go through a thousand events before the problem sequence.

-Steve