Re: auditd 2.0.5 and 2.2 log format changes
Thank you for valuable details. We will see what will happen in the field
By the way, do you have a plan to use Solaris bsm style output. All info
stored in a single line in bsm output. This is more human friendly output..
But redhat auditd create multi lines and every syscall has different number
of lines with different number of fields in every line.
Thanks
20 May 2014 20:02 tarihinde "Eric Paris" <eparis(a)redhat.com> yazdı:
On Tue, 2014-05-20 at 18:35 +0300, Ismail Yenigul wrote:
> Thanks for prompt reply.
>
>
>
> The kernel versions are very close.
Not really. RHEL kernels are vastly different than the old 2.6.32
kernel. In this case, the RHEL kernel gives some very very new
information which didn't exist back in 2.6.37. Aka the 2.6.32 rhel
kernel is 'newer' than the 2.6.37 suse kernel. Does that make sense?
> Redhat: 2.6.32-431.11.2.el6.x86_64
>
> Suse: 2.6.37.1-1.2-desktop
>
> > I have a scipt to correlate(for user friendly report) auditd
> 2.2
> > version logs. It works on RedHat.
> > We have suse 11.4 server running audit 2.0.5 version .
> >
> > I could not see any major log format difference between two
> version.
> > I see that there is nametype=NORMAL field difference at the
> end of
> > each line for version 2.2.
This is a new key=value pair which tells your something about this
particular name record. Imagine you called rename() and placed on file
on top of another existing file. In old kernels you'd end up with about
4 different audit names. Old parent dir, new parent dir, old file
moving, new file being unlink() because of the rename() on top of it.
This field is supposed to help you figure out which of these audit names
goes with which part of the syscall. Make sense?
Attachments:
- attachment.html (text/html — 2.3 KB)