Re: libauparse: read audit events continously?
Hi Steve,
Thanks for your reply.
On 08/10/2025 17:47, Steve Grubb wrote:
On Wednesday, October 8, 2025 11:03:41 AM Eastern Daylight Time
Jean-Jacques
Pitrolle wrote:
> Hi list,
> I'm looking for an example to receive auditd event *continously* and
> print them to the standard output.
>
> I found simple example which use *auparse* library here:
> https://security-plus-data-science.blogspot.com/2017/04/writing-basic-aupar
> se-program.html
> I add a the following lines to loop 'forever'
> 8<---
> [..]
> while (1) {
> auparse_first_record(au);
> [..]
> sleep(1);
> }
>
> auparse_destroy(au);
>
> return 0;
> }
> -->8
>
> The problem with this example is the output only shows the events which
> are available *before* binary startup not the event arrived *after*.
This construct is intended for files or memory buffers. Something that you
need to iterate across. What you want is the feed api. This is how all the
plugins work. You can find an example here:
https://github.com/linux-audit/audit-userspace/blob/master/contrib/plugin/
audisp-example.c#L117
Hmm ok i already modify the ids plugin to adapt it as a
test.
My purpose was to avoid the *plugin framework* this is why i was looking
for an example without any reference to *plugin*.
> 8<---
> ./dummy-auditd &
> ~ # Record type: DAEMON_START -
> type,op,ver,format,kernel,auid,pid,uid,ses,res
> Record type: CONFIG_CHANGE - type,op,audit_backlog_limit,old,auid,ses,res
> [..]
> Record type: PROCTITLE - type,proctitle
> Record type: 0 - (null)
> Record type: 0 - (null)
> ..
> -->8
>
> I want to have the event print *continously* i.e the new events *shall*
> appears on the standard output.
Note that plugins are designed to read stdin. So, you can cat a file into one
for testing purposes. A real plugin couldn't write to stdout because that is
/dev/null.
OK i want to avoid this infrastructure but it seems for my use-case i
can't avoid it.
So for my use case if i understand correctly i need the following
infrastructure
| auditd | --stdin--> | auditd-plugin | -- IPC --> | my-bin|
where IPC is a message queue or a named pipe that sends the expected
events to an external program my-bin.
Can you confirm this?
> Can you point me some examples in the git repository or an url that
> describes how to do it please?
Another example:
https://github.com/linux-audit/audit-userspace/blob/audit-3.1-maint/audisp/
plugins/statsd/audisp-statsd.c
> I surely miss something in the documentation so let me know if it is the
> case.
The feed API.
Thanks for the clarification; i think it would be possible to avoid
reading from stdin but it seems from your explanation it is not possible.
Regards.>
-Steve