Re: Audit/Auditd/Audispd documentation

On Thursday, November 13, 2014 02:20:02 PM Wojtczak Arkadiusz wrote: Yes, there is a little more documentation and sample code. Doesn't exist. What I have been doing is using ausearch-test to collect events. From that you can look through them. The audit events have to meet common criteria requirements which asks for date, time, subject, object, action, outcome. Each event has that somewhere. Generally the events have auid as the subject, the object varies based on what kind of event it is, the action is generally the type of event except syscalls - which the key that may be added serves as the action, the outcome is either sucess, res, or results. I have created a mapping here: http://people.redhat.com/sgrubb/audit/audit-events.txt This document describes all known fields. Doesn't exist. There are over 150 kinds of events. Some are deprecated, some are not. The best description for what they are is in the header file for the kernel and libaudit. https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/incl... https://fedorahosted.org/audit/browser/trunk/lib/libaudit.h#L40 Also, I have been writing some specifications around when and why certain events are created: http://people.redhat.com/sgrubb/audit/user-account-lifecycle.txt http://people.redhat.com/sgrubb/audit/audit-state-diagram.png I have another around logins that is in development and have another around virt/containers in works. The AVCs are created by a whole different community for their own needs. They more or less conform to the recommended style. If you have auditing enabled, you should also get a syscall record with the AVC. But if auditing is not enabled, then you won't. For DAC events, you get a syscall record. You have to specify what events you are interested in by the rules. I'd recommend the stig.rules as the best starting point -Steve