From mboxrd@z Thu Jan 1 00:00:00 1970 From: Burn Alting Subject: Are the writing of an events records to audit.log atomic should a log rotation occur Date: Sat, 02 Feb 2013 10:51:29 +1100 Message-ID: <1359762689.3612.11.camel@swtf> Reply-To: burn@swtf.dyndns.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============9209456677984520703==" Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r11NpYD9008190 for ; Fri, 1 Feb 2013 18:51:34 -0500 Received: from gateway.swtf.dyndns.org (203-219-87-38.static.tpgi.com.au [203.219.87.38]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r11NpXoa023979 for ; Fri, 1 Feb 2013 18:51:33 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by gateway.swtf.dyndns.org (Postfix) with ESMTP id 3EFAA24D005D for ; Sat, 2 Feb 2013 10:51:12 +1100 (EST) Received: from [192.168.2.100] (unknown [192.168.2.100]) by gateway.swtf.dyndns.org (Postfix) with ESMTP id 3653324D0045 for ; Sat, 2 Feb 2013 10:51:10 +1100 (EST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============9209456677984520703== Content-Type: multipart/alternative; boundary="=-EAE6AYWgroyGutSEeJR1" --=-EAE6AYWgroyGutSEeJR1 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit All, When rotating log files due a USR1 signal being sent, or for any other reason, does auditd finish writing all the records that belong to the current event being written before starting the new log file? That is, will I find records belonging to a single event in two log files? If this is the case, would there be problems if auditd was changed to wait and 'flush' all an event's records before rotating? One assumes auditd-event.c would need to be modified to be more event aware. Perhaps make use of AUDIT_EOE or other means of identifying the end of an event or a single event. Thanks in advance Burn Alting --=-EAE6AYWgroyGutSEeJR1 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: 7bit All,

When rotating log files due a USR1 signal being sent, or for any other reason, does auditd finish writing all the
records that belong to the current event being written before starting the new log file?

That is, will I find records belonging to a single event in two log files?

If this is the case, would there be problems if auditd was changed to wait and 'flush' all an event's records before
rotating? One assumes auditd-event.c would need to be modified to be more event aware. Perhaps make use of AUDIT_EOE or
other means of identifying the end of an event or a single event.

Thanks in advance

Burn Alting --=-EAE6AYWgroyGutSEeJR1-- --===============9209456677984520703== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============9209456677984520703==--