From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: Detecting gaps in the audit record Date: Thu, 01 Feb 2007 17:22:08 +0000 Message-ID: <1170350528.4259.10.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0674701234==" Return-path: Received: from [10.249.226.43] (sebastian-int.corp.redhat.com [172.16.52.221]) by pobox.surrey.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id l11JQPxJ025634 for ; Thu, 1 Feb 2007 19:26:30 GMT List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============0674701234== Content-Type: multipart/alternative; boundary="=-v2M7dJrMSLpyxbmOspL/" --=-v2M7dJrMSLpyxbmOspL/ Content-Type: text/plain Content-Transfer-Encoding: 7bit I notice that in normal operation audit event IDs are sequential. Is it sufficient to look for non-sequential audit events to detects gaps in the record? Are there any circumstances, including deliberate tampering, where this might not be sufficient? Thanks, Matt -- Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 --=-v2M7dJrMSLpyxbmOspL/ Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit I notice that in normal operation audit event IDs are sequential. Is it sufficient to look for non-sequential audit events to detects gaps in the record? Are there any circumstances, including deliberate tampering, where this might not be sufficient?

Thanks,

Matt
-- 
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490
--=-v2M7dJrMSLpyxbmOspL/-- --===============0674701234== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0674701234==--