Re: [RFC] New ausearch output option & audit viewing in Spacewalk
On 06/08/2009 01:12 PM, John Dennis wrote:
Joshua Roys wrote:
> Hello all.
>
> As part of developing an audit viewing "plugin"[1] to Spacewalk[2], I
> wrote a small program to use libauparse to output (easily)
> machine-parsable audit logs. I think this functionality would be nice
> to have in ausearch, and as such, wrote a patch for it.
>
> As well as reviewing this patch, I would like your feedback concerning
> the Spacewalk audit plugin. Any questions or constructive criticism is
> welcome.
Would you please post an example of the output and/or the parsing rules.
Thanks
Basically the following:
type=USER_ACCT
serial=222
seconds=1244481001
milli=141
user pid=24777
uid=root
auid=unset
ses=4294967295
subj=system_u:system_r:crond_t:s0-s0:c0.c1023
op=PAM:accounting
acct=root
exe=/usr/sbin/crond
hostname=?
addr=?
terminal=cron
res=success
----
type=CRED_ACQ
serial=223
seconds=1244481001
milli=141
user pid=24777
uid=root
auid=unset
ses=4294967295
subj=system_u:system_r:crond_t:s0-s0:c0.c1023
op=PAM:setcred
acct=root
exe=/usr/sbin/crond
hostname=?
addr=?
terminal=cron
res=success
----
type=LOGIN
serial=224
seconds=1244481001
milli=141
login pid=24777
uid=root
old auid=unset
new auid=root
old ses=4294967295
new ses=34
----
Simply key=value with all nodes separated by "----\n". I should note
that the patch has not been exhaustively tested, it's more of a RFC and
also a request for those more knowledgeable of the audit logs to improve
upon it.
Thanks,
Joshua Roys