From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rituraj Buddhisagar Subject: Excluding audit for BIND daemon Date: Fri, 22 Sep 2017 10:39:19 +0530 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3404421623438914708==" Return-path: Received: from mx1.redhat.com (ext-mx10.extmail.prod.ext.phx2.redhat.com [10.5.110.39]) by smtp.corp.redhat.com (Postfix) with ESMTPS id C6C4661F44 for ; Fri, 22 Sep 2017 05:09:23 +0000 (UTC) Received: from mail-qt0-f177.google.com (mail-qt0-f177.google.com [209.85.216.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 5B81761462 for ; Fri, 22 Sep 2017 05:09:21 +0000 (UTC) Received: by mail-qt0-f177.google.com with SMTP id t46so50102qtj.2 for ; Thu, 21 Sep 2017 22:09:21 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============3404421623438914708== Content-Type: multipart/alternative; boundary="001a1140d2b820b4840559c0369e" --001a1140d2b820b4840559c0369e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I have a DNS server for which the auditd was generating lot of system calls and flooding the logs. Due to this the server was under heavy memory usage as audisp-remote was hogging the memory. The log output for audisp-remote showed that the syscall was 49. Then I got to know from ausyscall command that the call number 49 corresponds to bind. Hence I have *excluded* the call to "bind". I have put in below line in the /etc/audit/audit.rules *-a exclude,always -S 49* I have put the above line before section 10.2.2 which says "Feel free to add below this line" (please note I am running Ubuntu 14.04 but I suppose auditd implementation is same across board) . After the exclusion - I no more see the syscall=3D49 line in /var/log/audit/audit.rules. So thats a success or sorts! *Probem/Issue/Query now*: After the exclusion, I do see audit events for cron , sudo etc. But I do not see a call for "vi" file open mode etc. *Background:* log output earlier which was flooding the logs and giving message " *dns1 audisp-remote: message repeated 6613 times: [ queue is full - dropping event"* *log:* *type=3DSYSCALL msg=3Daudit(1506025977.586:46629194): arch=3Dc000003e sysca= ll=3D49 success=3Dyes exit=3D0 a0=3D3 a1=3D7ffe540ecf20 a2=3Dc a3=3D0 items=3D0 ppi= d=3D22337 pid=3D22338 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D0 suid=3D0 fsuid=3D0 e= gid=3D0 sgid=3D0 fsgid=3D0 tty=3D(none) ses=3D4294967295 comm=3D"audisp-remote" exe=3D"/sbin/audisp-remote" key=3D"root_action"* root@dns1:/tmp# ausyscall 49 *bind* I do see audit events for cron , sudo etc. But I do not see a call for "vi" file open mode etc. Observation: I open file /etc/audit/audit.rules in vi editor and then close it. Audit log does not show syscall=3D2 Earlier I used to see below output in logs, but I am not sure that was for which file opened in vi editor. *type=3DSYSCALL msg=3Daudit(1506025995.825:46633170): arch=3Dc000003e sysca= ll=3D2 success=3Dyes exit=3D3 a0=3D5598f609a210 a1=3D200c1 a2=3D81a0 a3=3D0 items= =3D2 ppid=3D21957 pid=3D22355 auid=3D1006 uid=3D0 gid=3D0 euid=3D0 suid=3D0 fsuid=3D0 egid=3D= 0 sgid=3D0 fsgid=3D0 tty=3Dpts0 ses=3D361 comm=3D"vi" exe=3D"/usr/bin/vim.basic" key=3D"root_act= ion"* I did read a bit on auditd from below links. *Please let me know if I am missing something or are the calls getting audited in an expected way.* I went through below links; *would appreciate if someone can help with any references which are more lucid with example*s: https://linux-audit.com/configuring-and-auditing-linux-systems-with-audit-d= aemon/ https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/ht= ml/Security_Guide/chap-system_auditing.html Furthermore, I would like to read much on audisp-remote to send all these logs to a central server. I do not find any documentation on that. I see discussion on net where people are using rsyslog instead for that. Please help with references/links if any. Thanks! Best Regards, Rituraj B =E2=80=8B=E2=80=8B =E2=80=8B=E2=80=8B --001a1140d2b820b4840559c0369e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,=C2=A0

I have a DNS = server for which the auditd was generating lot of system calls and flooding= the logs.
Due to this =C2=A0the server= was under heavy memory usage as audisp-remote was hogging the memory.=C2= =A0 The log output for audisp-remote showed that the syscall was 49. Then I= got to know from ausyscall command that the call number 49 corresponds to = bind. Hence I have excluded the call to "bind".

I have p= ut in below line in the /etc/audit/audit.rules

-a exclude,always -S 49

I have put the above line before section= 10.2.2 which says "Feel free to add below this line" (please not= e I am running Ubuntu 14.04 but I suppose auditd implementation is same acr= oss board) .

After the exclusion= - I no more see the syscall=3D49 line in /var/log/audit/audit.rules. So th= ats a success or sorts!

Pr= obem/Issue/Query now: After the exclusion,=C2=A0I do see audit even= ts for cron , sudo etc. But I do not see a call for "vi" file ope= n mode etc.

Background:

log output earlier which was flooding the logs and giving message = "=C2=A0dns1 audisp-remote: message repeated 6613 times: [ queue is = full - dropping event"

= log:
type=3DSYSCALL msg=3Daudit(1506025= 977.586:46629194): arch=3Dc000003e syscall=3D49 success=3Dyes exit= =3D0 a0=3D3 a1=3D7ffe540ecf20 a2=3Dc a3=3D0 items=3D0 ppid=3D22337 pid=3D22= 338 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D0 suid=3D0 fsuid=3D0 egid=3D0 = sgid=3D0 fsgid=3D0 tty=3D(none) ses=3D4294967295 comm=3D"audisp-remote= " exe=3D"/sbin/audisp-remote" key=3D"root_action"<= /i>

root@dns1:/tmp# ausyscall 49
bind=


I do see audit events for cron , sudo etc.= But I do not see a call for "vi" file open mode etc.

Observation: I open file /etc/audit/audit.r= ules in vi editor and then close it. Audit log does not show syscall=3D2

Earlier I used to see below outpu= t in logs, but I am not sure that was for which file opened in vi editor.

type=3DSYSCALL msg=3Daudit(1506025995.825:46633170): arch= =3Dc000003e syscall=3D2 success=3Dyes exit=3D3 a0=3D5598f609a210 a1= =3D200c1 a2=3D81a0 a3=3D0 items=3D2 ppid=3D21957 pid=3D22355 auid=3D1006 ui= d=3D0 gid=3D0 euid=3D0 suid=3D0 fsuid=3D0 egid=3D0 sgid=3D0 fsgid=3D0 tty= =3Dpts0 ses=3D361 comm=3D"vi" exe=3D"/usr/bin/vim.bas= ic" key=3D"root_action"
=C2=A0=C2=A0<= /font>
I did read a bit on auditd from below links. Please l= et me know if I am missing something or are the calls getting audited in an= expected way.


I went= through below links; would appreciate if someone can help with any refe= rences which are more lucid with examples:

https://linux-audit.com/configuring-and-auditing-linu= x-systems-with-audit-daemon/
https://access.redhat.com/= documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-sys= tem_auditing.html

Furthermore, I would like to read much on audis= p-remote to send all these logs to a central server. I do not find any docu= mentation on that. I see discussion on net where people are using rsyslog i= nstead for that. Please help with references/links if any.

Thanks!
=

=E2=80=8B=E2=80=8B
<= /div> --001a1140d2b820b4840559c0369e-- --===============3404421623438914708== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3404421623438914708==--
Best Regards,
Rituraj= B
=E2=80=8B=E2=80=8B