last restart of auditd - in EPOCH time

last restart of auditd - in EPOCH time

[warron.french]

[-- Attachment #1.1: Type: text/plain, Size: 660 bytes --]

Is there a hidden switch option to auditctl that would tell me the last
time auditd was restart specifically in epoch (down to the second)?

If my rules are changed to non-immutable ( -e 1 ) rebooted, and then
changed back to immutable ( -e 2 ), then I discover this weeks later, then
I will not know for sure which was most recently updated/restarted.

That is the reason for the question.  I am doing this for a hardening
script that will tell me based on known recent changes (as of script
execution), but I cannot properly/successfully assess for dates outside of
a day or so.  :-/

Any ideas would be appreciated,
--------------------------
Warron French

[-- Attachment #1.2: Type: text/html, Size: 993 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: last restart of auditd - in EPOCH time

[Steve Grubb]

Hello,

On Wednesday, August 4, 2021 3:25:40 PM EDT warron.french wrote:
> Is there a hidden switch option to auditctl that would tell me the last
> time auditd was restart specifically in epoch (down to the second)?

Not auditctl, but maybe ausearch:
ausearch --start boot -m daemon_start -i

Or...
systemctl status auditd.service | grep Active

And if you need this in the epoch:
date --date="$(systemctl status auditd.service|grep Active|awk '{printf "%s 
%s", $6, $7}')" +"%s"

> If my rules are changed to non-immutable ( -e 1 ) rebooted, and then
> changed back to immutable ( -e 2 ), then I discover this weeks later, then
> I will not know for sure which was most recently updated/restarted.

That might be one issue with using ausearch...it might have scrolled away. 
Maybe this could be collected at start and printed as part of the auditd 
state report? I could see this being useful information for various reasons.

> That is the reason for the question.  I am doing this for a hardening
> script that will tell me based on known recent changes (as of script
> execution), but I cannot properly/successfully assess for dates outside of
> a day or so.  :-/

systemctl should be able to get you the info you need. I might add this info 
to the state report, though.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: last restart of auditd - in EPOCH time

[warron.french]

[-- Attachment #1.1: Type: text/plain, Size: 2286 bytes --]

Thanks for the info.
While driving home I realized that I had not considered using systemctl and
assessing the "Active:" field like you suggested here.

Then before reading your email I tried my own way, doing:
date +%s -d "$(systemctl status auditd | egrep Active | egrep -o
"[[:digit:]]{4}-[[:digit:]]{2}--[[:digit:]]{2}\s*[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}")"

What is interesting is that I would expect both commands to render the same
result, but for some reason your command reports today's date and time,
whereas mine renders the valid date and time (from last week, which I know
to be true).

When I say your command, I mean this one:
date --date="$(systemctl status auditd.service|grep Active|awk '{printf
"%s %s", $6, $7}')" +"%s"

AH!  I figured it out, I was missing the letter 'f' on printf.


--------------------------
Warron French



On Wed, Aug 4, 2021 at 4:03 PM Steve Grubb <sgrubb@redhat.com> wrote:

> Hello,
>
> On Wednesday, August 4, 2021 3:25:40 PM EDT warron.french wrote:
> > Is there a hidden switch option to auditctl that would tell me the last
> > time auditd was restart specifically in epoch (down to the second)?
>
> Not auditctl, but maybe ausearch:
> ausearch --start boot -m daemon_start -i
>
> Or...
> systemctl status auditd.service | grep Active
>
> And if you need this in the epoch:
> date --date="$(systemctl status auditd.service|grep Active|awk '{printf
> "%s
> %s", $6, $7}')" +"%s"
>
> > If my rules are changed to non-immutable ( -e 1 ) rebooted, and then
> > changed back to immutable ( -e 2 ), then I discover this weeks later,
> then
> > I will not know for sure which was most recently updated/restarted.
>
> That might be one issue with using ausearch...it might have scrolled away.
> Maybe this could be collected at start and printed as part of the auditd
> state report? I could see this being useful information for various
> reasons.
>
> > That is the reason for the question.  I am doing this for a hardening
> > script that will tell me based on known recent changes (as of script
> > execution), but I cannot properly/successfully assess for dates outside
> of
> > a day or so.  :-/
>
> systemctl should be able to get you the info you need. I might add this
> info
> to the state report, though.
>
> -Steve
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 3226 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit