On Monday, January 25, 2021 7:11:45 PM EST Burn Alting wrote:

On Mon, 2021-01-25 at 18:53 -0500, Steve Grubb wrote:

On Saturday, January 23, 2021 5:55:44 PM EST Burn Alting wrote:

How is the following for a way forward.

a. I will author a patch to the user space code to correctly parse

this

condition and submit it on the weekend. It will be via a new

configuration item to auditd.conf just in case placing a fixed

extended timeout (15-20 secs) affects memory usage for users of the

auparse library. This solves the initial problem of

ausearch/auparse

failing to parse generated audit.b. I am happy to instrument what

ever

is recommended on my hosts at home (vm's and bare metal) to provide

more information, should we want to 'explain' the occurrence, given

I

see this every week or two and report back.

Seems reasonable to me.

I can implement the 'end_of_event_timeout' change either as

i. a command line argument to ausearch/aureport (say --eoetmo secs) and

a

new pair of library functions within the  auparse() stable (say

auparse_set_eoe_timeout() and auparse_get_eoe_timeout())

or

ii. a configuration item in /etc/audit/auditd.conf, or

Which is your preference? Mine is i. as this is a user space processing

change, not a demon change.

To be honest, I'm not entirely sure what we're seeing. I run some tests

today on my system. It's seeing issues also. I'd still like to treat the

root cause of this. But we do need to change the default. That I what

I'm trying to figure out.

Back to your question, I'm wondering if we should do both? A changeable

default in auditd.conf and an override on the command line.

So far, all items in /etc/audit/auditd.conf appear to only affect the

daemon. Is this the right location to start adding non-daemon

configuration items? (I accept there is no other place).

ausearch/report/auparse all read the auditd.conf to find the canonical 

location for where the logs are supposed to be. So, they already read this 

file. I'd rather keep it there than make yet another config. The only drawback 

it that it might again confuse people that auditd really doesn't do anything 

with the records but just some light processing.

OK. I will put it in /etc/audit/auditd.conf

-Steve

Happy to do both, if required.

-Steve