Linux-audit Archive on lore.kernel.org
 help / color / Atom feed
* httpd auid = -1
@ 2020-07-30 17:54 Todd Heberlein
  2020-07-30 18:29 ` Steve Grubb
  0 siblings, 1 reply; 4+ messages in thread
From: Todd Heberlein @ 2020-07-30 17:54 UTC (permalink / raw)
  To: Linux-audit

I’ve noticed that the httpd process on a CentOS 7.7 system I am working with is running with an Audit ID of -1. Example ID values are:

	auid=4294967295
	uid=48
	gid=48
	...

So if use the standard filter "-F auid!=-1” in the audit rules I do not see httpd activity.

Is this common?

How do I change the auid to something else, so I can capture the httpd activity in the audit log?


Example audit line:

type=SYSCALL msg=audit(1596065566.721:31357): arch=c000003e syscall=2 success=yes exit=15 a0=55a0a2d9b3c0 a1=80000 a2=0 a3=7ffe5d4d6720 items=1 ppid=1130 pid=1253 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key=(null)


Thanks,

Todd


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-30 17:54 httpd auid = -1 Todd Heberlein
2020-07-30 18:29 ` Steve Grubb
2020-07-30 18:47   ` Todd Heberlein
2020-07-30 21:41     ` Steve Grubb

Linux-audit Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-audit/0 linux-audit/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-audit linux-audit/ https://lore.kernel.org/linux-audit \
		linux-audit@redhat.com
	public-inbox-index linux-audit

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.redhat.linux-audit


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git