Hello, On Thu, 25 Sep 2014 11:16:33 -0500 LC Bruzenak <lenny(a)magitekltd.com&gt; wrote: Not exactly. A regex would be for searching for events that match some criteria. That might be useful in and of itself. What this proposal is about is allowing one to specify how an event is output. For example, you may want some kind of xml looking thing. Or maybe html, or maybe json looking. Or maybe you just want it your way...just because. I know one of the limitations is that each event is unique. I am planning to address this in the near future by having a classifier that you just ask, what is the subject, what is the object, what was the action, what was the result. It would supply the answer. Then I could go back to this and add some new classifier virtual fields that could be $SUBJECT, $OBJECT, etc. But this proposal is purely about output and not searching. -Steve

Steve, Had a play around with it. I am not sure about it's value in it's current form. Rather than specifying the keys to print, it would be better to print everything in the event and only 'override' the standard formatting if there is an 'snode' for a key. Further, it has a couple of immediate issues given it's using libauparse. - it is "lossy" in that it wont parse poorly formed audit events (see the op key value pair below) [burn@swtf auformat]$ cat add_user.txt node=swtf.swtf.dyndns.org type=ADD_USER msg=audit(1411871714.393:47872): user pid=13455 uid=0 auid=500 ses=11 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding home directory id=502 exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/2 res=success' [burn@swtf auformat]$ ./auformat "%node %date %time %milli % serial: type=%TYPE msg=%msg op=%op auid=%auid pid=%pid path=% path exe=%exe subj=%subj hostname=%hostname terminal=%terminal res=%res\n" add_user.txt swtf.swtf.dyndns.org 09/28/2014 12:35:14 393 47872: type=ADD_USER msg= op=adding auid=500 pid=13455 path= exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 hostname=? terminal=pts/2 res=success [burn@swtf auformat]$ We loose the strings - 'user' before the pid key - op='adding home directory' becomes op'adding' This is particularly important for incorrectly formatted application level audit sent via auditd. - 'rewinding' the event's cursor for each possible key, the call to auparse_first_record() in print_item(), is probably not what one would want - but then again, auformat is just a mock up at the moment. - one looses the parsing 'fix-up' that ausearch does in src/ausearch-report.c:output_interpreted_node() - to build a complete event, having addressed the 'rewinding' issue, would make the format look very messy - you would need to include every possible key to print all key/values. - one should add event separation so that further tools could process the data more easily. At the moment, the only tool I'm aware of that 'correctly' parses a log file is ausearch. Perhaps we would be better served by adding another output option to ausearch to print events in a much more parse-able format (e.g. XML, JSON) I am happy to work on this (either extending ausearch or working on auformat). Rgds On Fri, 2014-09-26 at 10:24 -0500, LC Bruzenak wrote:

On Wed, 2014-10-01 at 14:44 -0400, Steve Grubb wrote: I suppose my concern is that until we have fixed all the incorrectly formatted key values, auparse is going to loose information. By 'fix-up' I meant the code like // Some user messages have msg='uid=500 in this case // skip the msg= piece since the real stuff is the uid= ... // Value side has commas and another field exists // Known: LABEL_LEVEL_CHANGE banners=none,none // Known: ROLL_ASSIGN new-role=r,r // Known: any MAC LABEL can potentially have commas etc So you expect the complete event of my tailing audit.log node=swtf.swtf.dyndns.org type=SYSCALL msg=audit(1412198543.190:141570): arch=c000003e syscall=59 success=yes exit=0 a0=1a2d530 a1=1a2d350 a2=1a06f10 a3=20 items=2 ppid=19529 pid=32647 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="tail" exe="/usr/bin/tail" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="cmds" node=swtf.swtf.dyndns.org type=EXECVE msg=audit(1412198543.190:141570): argc=3 a0="tail" a1="-f" a2="/var/log/audit/audit.log" node=swtf.swtf.dyndns.org type=CWD msg=audit(1412198543.190:141570): cwd="/home/burn" node=swtf.swtf.dyndns.org type=PATH msg=audit(1412198543.190:141570): item=0 name="/usr/bin/tail" inode=2135830 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL node=swtf.swtf.dyndns.org type=PATH msg=audit(1412198543.190:141570): item=1 name=(null) inode=524293 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL to generate one line of output? By correctly, I meant completely. It currently, in output_interpreted_node() handles incorrectly formed key values like op=adding home directory as per [burn@swtf auformat]$ /sbin/ausearch -i -if add_user.txt ---- node=swtf.swtf.dyndns.org type=ADD_USER msg=audit(09/28/2014 12:35:14.393:47872) : user pid=13455 uid=root auid=burn ses=11 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding home directory id=freddo exe=/usr/sbin/useradd hostname=? addr=? terminal=pts/2 res=success' [burn@swtf auformat]$ Which is my use case. - enrich the data e.g. uid=500 to become uid=500(burn) (I want both the id and interpreted name for checking id mismatches in the enterprise), syscall=59 to become syscall=execve, etc - not loose important data (op=adding home directory) - turn single and multi-line events into well defined and formatted events (xml/json), - send the data to an aggregation point within the enterprise. At the aggregation point I can apply capability such as logstash/elastic search/map reduce and analyse the data. Ideally I'd extend ausearch-report.c:output_record() to output events in a well defined format (xml/json) - probably refactoring output_interpreted_node() to generate it's current format or xml/json depending on a flag so we only have one 'parser' to maintain. Burn