Re: Kernel audit output is inconsistent, hard to parse

John Dennis
2008-01-30T01:15:36Z

Miloslav Trmac wrote:
> Hello,
> John Dennis napsal(a):
>> The current formatting of the record timestamp
>> (e.g. audit(ssss.mmm:iii) is inconsistent with
>> all other name/value pairs. It should be "seconds="sss"
>> milliseconds="mmm" serial="iii", this allows parsing to be regular and
>> consistent.
> Isn't this unnecessarily verbose? Just
> time="sss.mmm" serial="iii"
> would be smaller, easier to read - and it would allow using better time
> precision in the future.

It's a reasonable argument. I can see value in either approach.

>> It's a judgment call over when and how to introduce change
>> and the anticipated impact.
> If this change is implemented, we should use the opportunity to clean up
> other inconsistencies in audit messages - e.g. different messages use
> "success", "res" and "result" fields to record whether the audited
> operation was successful.
>
> Also note that similar changes are necessary in user-space, e.g.
> type=USER_ERR ...: ... msg='PAM: bad_ident acct=? :
> exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
> contains name-value pairs within a value, using both pairs of quotes.

Excellent points. Thank you for drawing attention to these.

--
John Dennis <jdennis@redhat.com>