Re: When is EOE generated?
Thanks for the response Steve.
What exact criteria the deamon uses when it strips EOE? Is it purely based on the size of
the event or remaining disk space or?
That leads me to the next question, can I force it to log EOE regardless?
--
Kind Regards,
Giovanni
On Thu, Sep 12, 2019, at 07:19, Steve Grubb wrote:
Hello,
On Tuesday, September 10, 2019 11:55:58 PM EDT Giovanni Panepinto wrote:
> According to
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/h
> tml/security_guide/sec-audit_record_types , the record EOE gets generated
> to represent "the end of a multi-record event."
>
> In my audit logs, I can see that for some events, EOE doesn't get
> generated.
<snip>
> So my question is, what defines a multi-record event? And why is EOE not
> generated when I create a file under /usr/local/bin?
The EOE record is stripped by the audit daemon to save disk space. The audit
libraries and utilities use heuristics to determine the end of an event. So,
if you are parsing events with auparse, it will figure out the end of the
event and group all related records for you. The EOE record is passes along
to the real time interface just in case it helps to mark an event complete
before the heuristics determine it is complete.
-Steve