From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Ruch Subject: Backlog exceeded when using audisp Date: Wed, 13 Aug 2014 14:37:52 -0700 Message-ID: <1407965872.73962.YahooMailNeo@web120705.mail.ne1.yahoo.com> Reply-To: Andy Ruch Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0375962976972210645==" Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s7DLbtgL008177 for ; Wed, 13 Aug 2014 17:37:55 -0400 Received: from nm10-vm5.bullet.mail.ne1.yahoo.com (nm10-vm5.bullet.mail.ne1.yahoo.com [98.138.91.232]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s7DLbrUD012208 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Wed, 13 Aug 2014 17:37:54 -0400 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Audit ML List-Id: linux-audit@redhat.com --===============0375962976972210645== Content-Type: multipart/alternative; boundary="1929490892-695622143-1407965872=:73962" --1929490892-695622143-1407965872=:73962 Content-Type: text/plain; charset=us-ascii Hello, I'm trying to send the audit logs on a secure RHEL 6.5 system to rsyslog. Rsyslog will then send them to another system for centralized collection. I can't have audisp send them directly because the connectivity is unreliable and rsyslog provides on disk queues for reliable delivery. I've activated the syslogplugin of audisp to do the transfer. The problem is getting the logs transferred fast enough. The system is configured to panic upon error (-f 2), which it does frequently when I do something like update the SELinux RPM since watching /etc/selinux is required by the STIG. I have the audit buffer size configured to 8192 and the audisp queue set to 120. I'm surprised the 8192 buffer is being overwhelmed. When I look at aureport for just the time frame of the action, I get approximately 350 events. I know that each event may have multiple entries, but it is interesting that the capacity of a buffer over 20 times bigger is being exceeded. Can anyone in a similar situation share any insights? Is there a faster way to transfer the logs rather than the audispsyslogplugin? We use to have rsyslog monitor the audit.log file but ran into some issues when we started dealing with log file rollover. And it just seems cleaner to send the audit logs directly. Thanks, Andrew Ruch --1929490892-695622143-1407965872=:73962 Content-Type: text/html; charset=us-ascii
Hello,

I'm trying to send the audit logs on a secure RHEL 6.5 system to rsyslog. Rsyslog will then send them to another system for centralized collection. I can't have audisp send them directly because the connectivity is unreliable and rsyslog provides on disk queues for reliable delivery. I've activated the syslog plugin of audisp to do the transfer. The problem is getting the logs transferred fast enough. The system is configured to panic upon error (-f 2), which it does frequently when I do something like update the SELinux RPM since watching /etc/selinux is required by the STIG.

I have the audit buffer size configured to 8192 and the audisp queue set to 120. I'm surprised the 8192 buffer is being over whelmed. When I look at aureport for just the time frame of the action, I get approximately 350 events. I know that each event may have multiple entries, but it is interesting that the capacity of a buffer over 20 times bigger is being exceeded.

Can anyone in a similar situation share any insights? Is there a faster way to transfer the logs rather than the audisp syslog plugin? We use to have rsyslog monitor the audit.log file but ran into some issues when we started dealing with log file rollover. And it just seems cleaner to send the audit logs directly.

Thanks,
Andrew Ruch
--1929490892-695622143-1407965872=:73962-- --===============0375962976972210645== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0375962976972210645==--