8:38 p.m.
Hi,
I set audit_backlog to 1024, and the logging flag to 0 (ignore).
still under heavy load I get:
audit: audit_lost=390 audit_backlog=3 audit_rate_limit=0
audit_backlog_limit=1024
[... other messages ...]
audit: audit_lost=702 audit_backlog=2 audit_rate_limit=0
audit_backlog_limit=1024
audit: audit_lost=703 audit_backlog=1 audit_rate_limit=0
audit_backlog_limit=1024
[... other messages ...]
audit: audit_lost=870 audit_backlog=24 audit_rate_limit=0
audit_backlog_limit=1024
[... more audit_lost messages ...]
audit: audit_lost=892 audit_backlog=2 audit_rate_limit=0
audit_backlog_limit=1024
This is around 30 lost audit events reported to syslog despite I
disabled this, the backlog is high enough and auditd is running (it
gets 102k lines in the first 60 seconds of my system startup)
Greetings,
Erich Schubert
--
erich(a)(mucl.de|debian.org) -- GPG Key ID: 4B3A135C (o_
To understand recursion you first need to understand recursion. //\
Wo befreundete Wege zusammenlaufen, da sieht die ganze Welt für V_/_
eine Stunde wie eine Heimat aus. --- Herrmann Hesse
9:01 a.m.
On Monday 21 February 2005 21:38, Erich Schubert wrote:
I set audit_backlog to 1024, and the logging flag to 0 (ignore).
still under heavy load I get:
Out of curiousity, what kernel & audit daemon version were you using?
What were your audit rules?
Did you change anything in auditd.conf?
Thanks,
-Steve Grubb
1:16 p.m.
Hi Steve,
Out of curiousity, what kernel & audit daemon version were you
using?
Running 2.6.11-rc4, auditd 0.6.3
What were your audit rules?
-f0 -b1024
-a entry,always -S execve
-a entry,always -S open
Did you change anything in auditd.conf?
Yes, my log file is located in a ram disk, and the settings are
log_file = /etc/audit-open/mnt/audit.log
max_log_file = 30
log_format = RAW
flush = NONE
space_left = 1
space_left_action = IGNORE
disk_full_action = IGNORE
Greetings,
Erich Schubert
--
erich(a)(mucl.de|debian.org) -- GPG Key ID: 4B3A135C (o_
To understand recursion you first need to understand recursion. //\
Wo befreundete Wege zusammenlaufen, da sieht die ganze Welt für V_/_
eine Stunde wie eine Heimat aus. --- Herrmann Hesse
2 p.m.
On Tuesday 22 February 2005 14:16, Erich Schubert wrote:
Yes, my log file is located in a ram disk, and the settings are
log_file = /etc/audit-open/mnt/audit.log
This is OK. But, there's one thing missing from your log in the first
post...the reason the record was lost. It should immediately follow the
message with audit_lost records totalled.
auditctl -s should give you the status of the audit system, make sure flag =
1. This tells the kernel to send the reason message to syslog. If you have
flag=0, then you'll never know why records are being dropped.
Can you look through the logs and see why records are being dropped?
Thanks,
-Steve Grubb
2:26 p.m.
In a slightly different setup (not during reboot, but in normal operation):
audit: netlink socket too busy
Greetings,
Erich Schubert
--
erich(a)(mucl.de|debian.org) -- GPG Key ID: 4B3A135C (o_
To understand recursion you first need to understand recursion. //\
Wo befreundete Wege zusammenlaufen, da sieht die ganze Welt für V_/_
eine Stunde wie eine Heimat aus. --- Herrmann Hesse
2:30 p.m.
I got that error a few weeks ago (previous version of the audit
software) when I was trying to audit all system calls. I assumed it was
just too much volume because when I audited only a subset of the calls
it worked fine.
Avishay Traeger
On Tue, 2005-02-22 at 12:26 -0800, Erich Schubert wrote:
2:34 p.m.
Hi,
I only audit "open" and "execve" calls. I'd like to not audit the
open
calls for /proc, but I can't filter these out early, it seems.
Greetings,
Erich Schubert
--
erich(a)(mucl.de|debian.org) -- GPG Key ID: 4B3A135C (o_
To understand recursion you first need to understand recursion. //\
Wo befreundete Wege zusammenlaufen, da sieht die ganze Welt für V_/_
eine Stunde wie eine Heimat aus. --- Herrmann Hesse
2:46 p.m.
Hi,
it seems that "ps" is very good at generating too many audit events.
This could undermine the usefulness seriously - when I can just do a
"while true; do ps > /dev/null; done" in one shell to overload the
audit system, then hope that my real actions get dropped.
Greetings,
Erich Schubert
--
erich(a)(mucl.de|debian.org) -- GPG Key ID: 4B3A135C (o_
To understand recursion you first need to understand recursion. //\
Wo befreundete Wege zusammenlaufen, da sieht die ganze Welt für V_/_
eine Stunde wie eine Heimat aus. --- Herrmann Hesse
4:04 p.m.
On Tuesday 22 February 2005 15:46, Erich Schubert wrote:
Yes. I tried your setup and could not get any netlink socket busy messages
while I had free disk space. I guess its hardware specific.
BUT, I did run into some items...
1) low disk space notification did not seem to work
2) it still tried to log even with disk full
3) netlink busy soon followed disk full
4) The system became unstable - first slow, then heavy disk swapping, then
unresponsive
5) had to hit reset button
6) could not get back into system without rescue disk.
Not very good.
This points to a couple issues. 1) I need to look at userspace and see what's
up with disk space detection. 2) The kernel has a serious problem when
netlink socket busy scrolls across the screen for a while. I was using the
kernel-2.6.9-5.EL.audit.6 from David's yum repo.
-Steve
7534
days inactive
7534
days old
linux-audit@lists.linux-audit.osci.io
8 comments
3 participants
participants (3)
-
Avishay Traeger -
Erich Schubert -
Steve Grubb