Re: no logging of successful events?

[Brian LaMere <brianl@clinicomp.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1346 bytes --]

> The recent versions of the audit system ships with a stig.rules file
> that give 
> what I believe to be a correct rule set. What the official docs say to
> do is 
> another thing. :)  Take a look at that file and see how I do the
> unauthorized 
> file access.


Excellent!  I had simply changed to the following, in a minimalistic
approach:

----------------------------------------------------
-w /etc/auditd.conf
-w /etc/audit.rules
-a exit,always -S open -F success=0
-a exit,always -S rmdir -S unlink -S chmod -S fchmod -S chown -S fchown
-S lchown -F success!=0
-a exit,always -S settimeofday -S setrlimit -S setdomainname -S
sched_setparam -S sched_setscheduler -S acct -S reboot -S swapon
-------------------------------------------------

Was grouping by failed, successful, and both.  Did this due to reading
that every audit rule is tested for every syscall, which...yeah, makes
me want to group things.

That being said, stig.rules is extensive; any warning on what the
performance impact will be?

Also, when looking for the newer builds on your site
http://people.redhat.com/sgrubb/audit/ - I noticed "1.7 -> 1.8 Remote
logging and finishing up IDS/IPS plugin."  That would be wonderously
fabulous, and I look forward to it.   Any thoughts on whether it will be
pulled into RHEL5, or whether I'd have to wait until RHEL6?

Brian

[-- Attachment #1.2: Type: text/html, Size: 1829 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]