8:55 p.m.
When audit.log is opened with cat or less, for example, with log format
= ENRICHED, there's no space between data and the enriched part, only
AUDIT_INTERP_SEPARATOR (0x1d):
type=USER_CMD msg=audit(1631669179.082:2403): ... res=success'UID="enzo"
AUID="unset"
^ (0x1d)
sep_done should be checked if it's 1 as well, so a space is added before
the first enriched field.
Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de>
---
src/auditd-event.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/auditd-event.c b/src/auditd-event.c
index 788c44a08197..636553187279 100644
--- a/src/auditd-event.c
+++ b/src/auditd-event.c
@@ -365,7 +365,7 @@ static int add_simple_field(auparse_state_t *au, size_t len_left, int
encode)
// Setup pointer
ptr = &format_buf[FORMAT_BUF_LEN - len_left];
- if (sep_done > 1) {
+ if (sep_done >= 1) {
*ptr = ' ';
ptr++;
num = 1;
--
2.33.0
10:32 p.m.
On Tuesday, September 14, 2021 9:55:48 PM EDT Enzo Matsumiya wrote:
When audit.log is opened with cat or less, for example, with log
format
= ENRICHED, there's no space between data and the enriched part, only
AUDIT_INTERP_SEPARATOR (0x1d):
This is by design.
type=USER_CMD msg=audit(1631669179.082:2403): ...
res=success'UID="enzo"
AUID="unset" ^ (0x1d)
sep_done should be checked if it's 1 as well, so a space is added before
the first enriched field.
Why?
Thanks,
-Steve
Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de>
---
src/auditd-event.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/auditd-event.c b/src/auditd-event.c
index 788c44a08197..636553187279 100644
--- a/src/auditd-event.c
+++ b/src/auditd-event.c
@@ -365,7 +365,7 @@ static int add_simple_field(auparse_state_t *au, size_t
len_left, int encode)
// Setup pointer
ptr = &format_buf[FORMAT_BUF_LEN - len_left];
- if (sep_done > 1) {
+ if (sep_done >= 1) {
*ptr = ' ';
ptr++;
num = 1;
9:52 a.m.
On 09/14, Steve Grubb wrote:
On Tuesday, September 14, 2021 9:55:48 PM EDT Enzo Matsumiya wrote:
> When audit.log is opened with cat or less, for example, with log format
> = ENRICHED, there's no space between data and the enriched part, only
> AUDIT_INTERP_SEPARATOR (0x1d):
This is by design.
I understand that, and the patch doesn't break it.
> type=USER_CMD msg=audit(1631669179.082:2403): ...
res=success'UID="enzo"
> AUID="unset" ^ (0x1d)
>
> sep_done should be checked if it's 1 as well, so a space is added before
> the first enriched field.
Why?
Some people still rely on opening audit.log with tools that are not aware
of the log format.
As far as I could test, the change is only cosmetic, as I expected. I did a
basic test with ausearch and it was ok.
Please clarify if you expect anything else to be affected by this
change.
Cheers,
Enzo
12:44 p.m.
On Wednesday, September 15, 2021 10:52:28 AM EDT Enzo Matsumiya wrote:
On 09/14, Steve Grubb wrote:
>On Tuesday, September 14, 2021 9:55:48 PM EDT Enzo Matsumiya wrote:
>> When audit.log is opened with cat or less, for example, with log format
>> = ENRICHED, there's no space between data and the enriched part, only
>
>> AUDIT_INTERP_SEPARATOR (0x1d):
>This is by design.
I understand that, and the patch doesn't break it.
>> type=USER_CMD msg=audit(1631669179.082:2403): ...
res=success'UID="enzo"
>> AUID="unset" ^ (0x1d)
>>
>> sep_done should be checked if it's 1 as well, so a space is added before
>> the first enriched field.
>
>Why?
Some people still rely on opening audit.log with tools that are not aware
of the log format.
There is another log format, RAW, which should be suitable for the old tools.
Also, I don't understand what problems that causes. You haven't exactly
explained what the problem is and why this is needed. The ENRICHED format has
been documented for over 5 years. Plenty of time for tools to become aware.
As far as I could test, the change is only cosmetic, as I expected. I
did a
basic test with ausearch and it was ok.
Please clarify if you expect anything else to be affected by this
change.
Without more context, I am reluctant to change a documented standard that has
existed for over 5 years.
https://github.com/linux-audit/audit-documentation/wiki/SPEC-Audit-Event-...
-Steve
12:55 p.m.
On 09/15, Steve Grubb wrote:
There is another log format, RAW, which should be suitable for the old
tools.
Also, I don't understand what problems that causes. You haven't exactly
explained what the problem is and why this is needed. The ENRICHED format has
been documented for over 5 years. Plenty of time for tools to become aware.
...
Again, the change was only cosmetic for when you "cat
/var/log/audit/audit.log" -- no problems otherwise.
Without more context, I am reluctant to change a documented standard
that has
existed for over 5 years.
https://github.com/linux-audit/audit-documentation/wiki/SPEC-Audit-Event-...
Please drop it then. I'll work on changing the default log_format back to
RAW for future SLES releases.
Cheers,
Enzo
1193
days inactive
1193
days old
linux-audit@lists.linux-audit.osci.io
4 comments
2 participants
participants (2)
-
Enzo Matsumiya -
Steve Grubb