From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: [PATCH] Audit: save audit_backlog_limit audit messages in case auditd comes back Date: Fri, 28 Mar 2008 10:50:16 -0500 Message-ID: <1206719416.6600.17.camel@homeserver> References: <1206653864.2878.19.camel@localhost.localdomain> <200803271750.09037.sgrubb@redhat.com> <1206665523.2878.23.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1206665523.2878.23.camel@localhost.localdomain> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Eric Paris Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thu, 2008-03-27 at 20:52 -0400, Eric Paris wrote: > On Thu, 2008-03-27 at 17:50 -0400, Steve Grubb wrote: > > On Thursday 27 March 2008 17:37:44 Eric Paris wrote: > > > This is useful to collect audit messages during bootup and even when auditd > > > is stopped. This is NOT a reliable mechanism, it does not ever call > > > audit_panic, nor should it. > > > > Thanks Eric for working on this. We've needed this for quite a while so that > > we can see some of the avcs that happen during boot. > > > > > > > If auditd never starts the kernel will hold by default up to 64 messages > > > in memory forever. > > > > I have an idea. Maybe this behavior could be enabled if audit=1 is passed as a > > boot parameter. In this way, you would know that the user intended for the > > audit daemon to start at some point. You could then call audit panic or > > whatever else is normal. If no audit=1 is passed, you could just do the > > printk like usual and not waste memory. Would this be helpful? > > I could probably do that. I also could conditionalize it on auditd ever > having run. I can't imagine it is normal for auditd to be running and > then stopped forever.... Unless it is an IDS-like event. Or a sysadmin makes a mistake. > > Anyone else see value in that situation? Only do it on boot if audit=1 > is passed? Does anyone actually use that command line option? I will start using it. Audit collected as early in the boot sequence as possible is better. > > -Eric > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit -- LC (Lenny) Bruzenak lenny@magitekltd.com