Re: ausearch question
On Monday, April 07, 2014 04:29:34 PM Burn Alting wrote:
All,
I note when interpreting raw audit with the ausearch --interpret option,
the code in src/ausearch-report.c:output_interpreted_node(), when
parsing key value pairs which are not enclosed in double or single
quotes, looks for embedded comma's in the value part and, if found,
effectively terminates the value at the comma. This in effect, makes the
data after the comma the start of the next key (if any). There are some
exceptions in the code (audit_type == AUDIT_VIRT_MACHINE_ID,
AUDIT_OBJ_PID, AUDIT_PATH and AUDIT_IPC).
I presume we are talking about this area of code:
https://fedorahosted.org/audit/browser/trunk/src/ausearch-report.c#L276
What sort of input is this addressing?
The audit system has migrated its events slowly over time. The current code
base can read/search/report/interpret audit events all the way back to about
the 2004 time frame. So, sometimes you find things that are left over from long
ago. But you might need this legacy support if the tools are on an aggregating
server.
Are there examples?
type=USER_ACCT msg=audit(1223987805.696:8): user pid=4885 uid=0
auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM:
accounting acct="sgrubb" : exe="/usr/sbin/gdm-binary" (hostname=?,
addr=?,
terminal=:0 res=success)'
Up until around 2010, all user space originating events had commas between the
last 4 fields which also including being inside parenthesis. This was later
decided to be a waste of bytes and slowed down parsing to handle the comma for
matching/translating purposes. Current events do not have this.
If you see any current events that are mishandled by this legacy code, let me
know and I'll see how we can fix it.
-Steve