Help with audit syscall event output

Help with audit syscall event output

[Ankitha Kundhuru]

[-- Attachment #1.1: Type: text/plain, Size: 489 bytes --]

Hi All,

Any help is greatly appreciated.

My piece of code can read audit.log file and process it.But when I enable
good number of syscalls, disk gets filled really quick (15GB for half a day
usage)
I wanted to know if there is a way to directly get the events from
userspace audit daemon instead of writing it to a file. Plan is that my
application should process the events as soon as they are created.
Suggest me if a way exist.

Thanks in advance.

Thanks & Regards,
Ankitha Kundhuru

[-- Attachment #1.2: Type: text/html, Size: 753 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Help with audit syscall event output

[Steve Grubb]

On Tuesday, September 3, 2019 5:15:29 PM EDT Ankitha Kundhuru wrote:
> Any help is greatly appreciated.
> 
> My piece of code can read audit.log file and process it.But when I enable
> good number of syscalls, disk gets filled really quick (15GB for half a day
> usage)
> I wanted to know if there is a way to directly get the events from
> userspace audit daemon instead of writing it to a file. Plan is that my
> application should process the events as soon as they are created.

Yes, there is a presentation that describes the architecture of the audit 
system including the realtime event interface:

http://people.redhat.com/sgrubb/audit/audit_ids_2011.pdf

And there is sample code for a plugin here:

https://github.com/linux-audit/audit-userspace/tree/master/contrib/plugin

-Steve

Re: Help with audit syscall event output

[Ankitha Kundhuru]

[-- Attachment #1.1: Type: text/plain, Size: 958 bytes --]

Awesome, thanks!

Thanks & Regards,
Ankitha Kundhuru


On Tue, Sep 3, 2019 at 5:24 PM Steve Grubb <sgrubb@redhat.com> wrote:

> On Tuesday, September 3, 2019 5:15:29 PM EDT Ankitha Kundhuru wrote:
> > Any help is greatly appreciated.
> >
> > My piece of code can read audit.log file and process it.But when I enable
> > good number of syscalls, disk gets filled really quick (15GB for half a
> day
> > usage)
> > I wanted to know if there is a way to directly get the events from
> > userspace audit daemon instead of writing it to a file. Plan is that my
> > application should process the events as soon as they are created.
>
> Yes, there is a presentation that describes the architecture of the audit
> system including the realtime event interface:
>
> http://people.redhat.com/sgrubb/audit/audit_ids_2011.pdf
>
> And there is sample code for a plugin here:
>
> https://github.com/linux-audit/audit-userspace/tree/master/contrib/plugin
>
> -Steve
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 1709 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]