From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40B04C433E0 for ; Tue, 26 Jan 2021 00:21:08 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A132922EBD for ; Tue, 26 Jan 2021 00:21:07 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A132922EBD Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=linux-audit-bounces@redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1611620466; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=4sEGsNK0o/sBhY0ysV3zxmF5EhUAicSV5EZ2XHnPFcI=; b=itodKyNatvYTBWFDBIdVssXRzdOxhkBpTQW07P6hqXOpZ8kqCdaGUEOAUS3hskx1e5IWAE bBDQkgwc86qXE8r7j/Hbf2N+6NMKBGzbf6JeLbv5rC4s0AmQkYsxV3A8OBliRIrDiBbaJg zWeN+9UQApS2q+Qme3BYojg7EuOQQw4= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-339--ufmbP-rP-628hSQGPNNrw-1; Mon, 25 Jan 2021 19:21:03 -0500 X-MC-Unique: -ufmbP-rP-628hSQGPNNrw-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id B052494F10; Tue, 26 Jan 2021 00:21:00 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 72DE261D33; Tue, 26 Jan 2021 00:21:00 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id E92EC4BB7B; Tue, 26 Jan 2021 00:20:41 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 10Q0KeQU013735 for ; Mon, 25 Jan 2021 19:20:40 -0500 Received: by smtp.corp.redhat.com (Postfix) id 930DA100AE43; Tue, 26 Jan 2021 00:20:40 +0000 (UTC) Received: from x2.localnet (ovpn-117-75.rdu2.redhat.com [10.10.117.75]) by smtp.corp.redhat.com (Postfix) with ESMTP id B717810016FA; Tue, 26 Jan 2021 00:20:34 +0000 (UTC) From: Steve Grubb To: burn@swtf.dyndns.org Subject: Re: Occasional delayed output of events Date: Mon, 25 Jan 2021 19:20:33 -0500 Message-ID: <3094935.aeNJFYEL58@x2> Organization: Red Hat In-Reply-To: <702bbf002465236ec84ff4f90b9e159ccc3f327d.camel@iinet.net.au> References: <30c5dbc14368a1919717e2f39d2d4c29463c3108.camel@iinet.net.au> <11685937.O9o76ZdvQC@x2> <702bbf002465236ec84ff4f90b9e159ccc3f327d.camel@iinet.net.au> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: linux-audit@redhat.com Cc: Richard Guy Briggs , Linux Audit X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit On Monday, January 25, 2021 7:11:45 PM EST Burn Alting wrote: > On Mon, 2021-01-25 at 18:53 -0500, Steve Grubb wrote: > > On Saturday, January 23, 2021 5:55:44 PM EST Burn Alting wrote: > > > > > How is the following for a way forward. > > > > > a. I will author a patch to the user space code to correctly parse > > > > > this > > > > > condition and submit it on the weekend. It will be via a new > > > > > configuration item to auditd.conf just in case placing a fixed > > > > > extended timeout (15-20 secs) affects memory usage for users of the > > > > > auparse library. This solves the initial problem of > > > > > ausearch/auparse > > > > > failing to parse generated audit.b. I am happy to instrument what > > > > > ever > > > > > is recommended on my hosts at home (vm's and bare metal) to provide > > > > > more information, should we want to 'explain' the occurrence, given > > > > > I > > > > > see this every week or two and report back. > > > > > > > > Seems reasonable to me. > > > > > > I can implement the 'end_of_event_timeout' change either as > > > i. a command line argument to ausearch/aureport (say --eoetmo secs) and > > > a > > > new pair of library functions within the auparse() stable (say > > > auparse_set_eoe_timeout() and auparse_get_eoe_timeout()) > > > or > > > ii. a configuration item in /etc/audit/auditd.conf, or > > > > > > > > > Which is your preference? Mine is i. as this is a user space processing > > > change, not a demon change. > > > > To be honest, I'm not entirely sure what we're seeing. I run some tests > > today on my system. It's seeing issues also. I'd still like to treat the > > root cause of this. But we do need to change the default. That I what > > I'm trying to figure out. > > > > Back to your question, I'm wondering if we should do both? A changeable > > default in auditd.conf and an override on the command line. > > So far, all items in /etc/audit/auditd.conf appear to only affect the > daemon. Is this the right location to start adding non-daemon > configuration items? (I accept there is no other place). ausearch/report/auparse all read the auditd.conf to find the canonical location for where the logs are supposed to be. So, they already read this file. I'd rather keep it there than make yet another config. The only drawback it that it might again confuse people that auditd really doesn't do anything with the records but just some light processing. -Steve > Happy to do both, if required. > > > -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit