Re: How to monitor audit/audispd killed
On Tuesday, January 05, 2016 03:29:31 AM Matthew Chao wrote:
>You have a race condition where auditd gets a signal to shutdown
and an
event indicating that shutdown is occurring. On shutdown, the audit daemon
does not alter the rules or whether auditing is enabled. (This was to get
shutdown AVCs for selinux.) There is a chance that your event is in syslog's
files.
For clarity, I am still not sure whether audit rules can be written to
monitor auditd/auispd killed or not (syslog was disabled under my
circumstances ).
You cannot audit the audit daemon's pid. Otherwise servicing an event could
create several more events which cause even more and you get an exponential
increase in logging until it dies.
You can watch audispd, but I don't think that will help anything.
If yes, could you give me some tips? Thanks.
The audit daemon is required to log some information about why it shutdown. If
you have a daemon_end event, this is the required information. Is there
something not in the event that you need?
-Steve