filtering out audit output

filtering out audit output

[Levy, Mark (IT Solutions)]

[-- Attachment #1.1: Type: text/plain, Size: 3855 bytes --]

Hi, I'm trying to find a way to filter out some of the excess output from netiq which does a df every 10 seconds. I haven't had any success yet and was hoping someone could point me the right direction. Below is the output that I would like to filter out.

  node=newman.netiq.northgrum.com type=CWD msg=audit(02/01/2011 01:26:09.976:336030) :  cwd=/usr/netiq/vsau/bin
node=newman.netiq.northgrum.com type=EXECVE msg=audit(02/01/2011 01:26:09.976:336030) : argc=(null) a0=/bin/df a1=-kP a2=../local/spool
node=newman.netiq.northgrum.com type=SYSCALL msg=audit(02/01/2011 01:26:09.976:336030) : arch=x86_64 syscall=execve per=400000 success=yes exit=0 a0=7fffe76acc58 a1=7fffe76aa
af8 a2=603c90 a3=0 items=2 ppid=3465 pid=9347 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=df exe
=/bin/df key=(null)
----
node=newman.netiq.northgrum.com type=PATH msg=audit(02/01/2011 01:26:20.019:336035) : item=1 name=(null) inode=2420400 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00
node=newman.netiq.northgrum.com type=PATH msg=audit(02/01/2011 01:26:20.019:336035) : item=0 name=/bin/df inode=2812595 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00

node=newman.netiq.northgrum.com type=CWD msg=audit(02/01/2011 01:26:20.019:336035) :  cwd=/usr/netiq/vsau/bin
node=newman.netiq.northgrum.com type=EXECVE msg=audit(02/01/2011 01:26:20.019:336035) : argc=(null) a0=/bin/df a1=-kP a2=../local/spool
node=newman.netiq.northgrum.com type=SYSCALL msg=audit(02/01/2011 01:26:20.019:336035) : arch=x86_64 syscall=execve per=400000 success=yes exit=0 a0=7fff691c1c58 a1=7fff691bf
b68 a2=603c90 a3=0 items=2 ppid=3465 pid=9355 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=df exe
=/bin/df key=(null)
----
node=newman.netiq.northgrum.com type=PATH msg=audit(02/01/2011 01:26:30.055:336036) : item=1 name=(null) inode=2420400 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00
node=newman.netiq.northgrum.com type=PATH msg=audit(02/01/2011 01:26:30.055:336036) : item=0 name=/bin/df inode=2812595 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00

node=newman.netiq.northgrum.com type=CWD msg=audit(02/01/2011 01:26:30.055:336036) :  cwd=/usr/netiq/vsau/bin
node=newman.netiq.northgrum.com type=EXECVE msg=audit(02/01/2011 01:26:30.055:336036) : argc=(null) a0=/bin/df a1=-kP a2=../local/spool
node=newman.netiq.northgrum.com type=SYSCALL msg=audit(02/01/2011 01:26:30.055:336036) : arch=x86_64 syscall=execve per=400000 success=yes exit=0 a0=7fffc4b4ec58 a1=7fffc4b4e
378 a2=603c90 a3=0 items=2 ppid=3465 pid=9356 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=df exe
=/bin/df key=(null)
----
node=newman.netiq.northgrum.com type=PATH msg=audit(02/01/2011 01:26:40.092:336051) : item=1 name=(null) inode=2420400 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00
node=newman.netiq.northgrum.com type=PATH msg=audit(02/01/2011 01:26:40.092:336051) : item=0 name=/bin/df inode=2812595 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00

node=newman.netiq.northgrum.com type=CWD msg=audit(02/01/2011 01:26:40.092:336051) :  cwd=/usr/netiq/vsau/bin
node=newman.netiq.northgrum.com type=EXECVE msg=audit(02/01/2011 01:26:40.092:336051) : argc=(null) a0=/bin/df a1=-kP a2=../local/spool
node=newman.netiq.northgrum.com type=SYSCALL msg=audit(02/01/2011 01:26:40.092:336051) : arch=x86_64 syscall=execve per=400000 success=yes exit=0 a0=7fff2b0d4c58 a1=7fff2b0d2
af8 a2=603c90 a3=0 items=2 ppid=3465 pid=9372 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=df exe
=/bin/df key=(null)

Thanks for any help

Mark


[-- Attachment #1.2: Type: text/html, Size: 4765 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: filtering out audit output

[Steve Grubb]

On Tuesday, February 01, 2011 02:34:23 pm Levy, Mark (IT Solutions) wrote:
> Hi, I'm trying to find a way to filter out some of the excess output from
> netiq which does a df every 10 seconds. I haven't had any success yet and
> was hoping someone could point me the right direction. Below is the output
> that I would like to filter out.
> 
>   node=newman.netiq.northgrum.com type=CWD msg=audit(02/01/2011
> 01:26:09.976:336030) :  cwd=/usr/netiq/vsau/bin
> node=newman.netiq.northgrum.com type=EXECVE msg=audit(02/01/2011
> 01:26:09.976:336030) : argc=(null) a0=/bin/df a1=-kP a2=../local/spool
> node=newman.netiq.northgrum.com type=SYSCALL msg=audit(02/01/2011
> 01:26:09.976:336030) : arch=x86_64 syscall=execve per=400000 success=yes
> exit=0 a0=7fffe76acc58 a1=7fffe76aa af8 a2=603c90 a3=0 items=2 ppid=3465
> pid=9347 auid=unset uid=root gid=root euid=root suid=root fsuid=root
> egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=df exe
> =/bin/df key=(null)
> ----

This looks like you have an audit rule for execve. Do you have some reason to audit 
execve? If not, I would place watches on the programs you care about and not capture 
all execve. Or do you care about programs that users run rather than the system 
running? In that case, I would restrict the execve to auid>=500 and  auid!=4294967295. 
If you just don't want df, near the top try this:

-a exit,never -F path=/bin/df -F perm=x

It has to be before the rule that triggers the execve because the audit system has a 
first match wins rule engine. You may need a recent kernel for that to work as it did 
not work as intended at first.

-Steve