Re: no logging of successful events?

[Brian LaMere <brianl@clinicomp.com>]

(boo for me not hitting reply-all before)

Fair enough, was just basing from the man page which says:

"       To see unsuccessful open call's:

       auditctl -a exit,always -S open -F success!=0"

So am I just not understanding the man page well?   Clearly I'll have to
take your word for it, you being the maintainer for RH and all, but it
might be the man page itself causing the confusion for lots of people.
Note that I actually got the line from the DoD requirements, which give
that line - if that line isn't present, then they determine that "the
audit system is not configured to audit failed attempts to access files
and programs."

If you're curious, the linux audit requirements in the DoD are publicly
available at
http://iase.disa.mil/stigs/checklist/unix_checklist_v5r1-13_20080715.ZIP

The specific control is defined in PDI GEN002720.  They have several
mistakes in that section (the HPUX stuff is wrong too) so I wouldn't be
remotely surprised to find there is an issue with the linux section.

And I just noticed that my example audit rules don't have the -F...on
the systems where it is a problem, the -F is there.

On Mon, 2008-08-18 at 15:18 -0400, Steve Grubb wrote:
> On Monday 18 August 2008 15:09:34 Brian LaMere wrote:
> > So...why is it that "LIST_RULES: exit,always success!=0 syscall=open"
> > doesn't disregard the successful calls? 
> 
> Because that means log the successful calls. If you only want the unsuccessful 
> calls, I'd suggest success = 0. Its easy to confuse the success field with 
> exits codes which return 0 for success. This question pops up every now and 
> again.  :)
> 
> -Steve