Clear kernel audit buffer?

Clear kernel audit buffer?

[Aaron Lewis]

Hi,

I'm doing a stress test on auditd, so I add a rule to monitor "open"
syscall, then I use a c program to generate massive amount of logs.
The program finished and exited.

But I generated too much, if I kill auditd and start it again, I can
still see a lot of type=SYSCALL logs. (But not CWD or PATH)

Can I clear the existing buffer?

-- 
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E

Re: Clear kernel audit buffer?

[Richard Guy Briggs]

On 13/12/26, Aaron Lewis wrote:
> Hi,
> 
> I'm doing a stress test on auditd, so I add a rule to monitor "open"
> syscall, then I use a c program to generate massive amount of logs.
> The program finished and exited.
> 
> But I generated too much, if I kill auditd and start it again, I can
> still see a lot of type=SYSCALL logs. (But not CWD or PATH)
> 
> Can I clear the existing buffer?

Did you remove the rule that caused the massive amount of logging?

Auditd will drain that buffer.  The default is a queue of 64 messages,
which should drain reasonably quickly if the rule has been removed and
the queue length hasn't been overridden to a huge value.  Otherwise,
there is no other way to drain that buffer.

> Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: Clear kernel audit buffer?

[Aaron Lewis]

Hi Richard,

Thanks for the quick reply.

Yes, I did run auditctl -D to clear all rules. And during testing I
have enlarged the buffer queue to 10240 messages.

Did you mean that once -D is issued, the buffer will be cleared by
auditd, but not by linux kernel?


On Tue, Jan 14, 2014 at 3:24 AM, Richard Guy Briggs <rgb@redhat.com> wrote:
> On 13/12/26, Aaron Lewis wrote:
>> Hi,
>>
>> I'm doing a stress test on auditd, so I add a rule to monitor "open"
>> syscall, then I use a c program to generate massive amount of logs.
>> The program finished and exited.
>>
>> But I generated too much, if I kill auditd and start it again, I can
>> still see a lot of type=SYSCALL logs. (But not CWD or PATH)
>>
>> Can I clear the existing buffer?
>
> Did you remove the rule that caused the massive amount of logging?
>
> Auditd will drain that buffer.  The default is a queue of 64 messages,
> which should drain reasonably quickly if the rule has been removed and
> the queue length hasn't been overridden to a huge value.  Otherwise,
> there is no other way to drain that buffer.
>
>> Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
>
> - RGB
>
> --
> Richard Guy Briggs <rbriggs@redhat.com>
> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
> Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545



-- 
Best Regards,
Aaron Lewis - PGP: 0x13714D33 - http://pgp.mit.edu/
Finger Print:   9F67 391B B770 8FF6 99DC  D92D 87F6 2602 1371 4D33

Re: Clear kernel audit buffer?

[Steve Grubb]

On Tuesday, January 14, 2014 01:09:52 PM Aaron Lewis wrote:
> Yes, I did run auditctl -D to clear all rules. And during testing I
> have enlarged the buffer queue to 10240 messages.
> 
> Did you mean that once -D is issued, the buffer will be cleared by
> auditd, but not by linux kernel?

There is no way to directly clear the in kernel buffer. The audit system is 
supposed to keep events for disposition. If there was a simple command to dump 
events, that would be a simple way to circumvent detection. So, the best way 
to drain the queues is to give auditd more priority so it runs more often and 
longer before its time slice is up. You don't need to log to disk. But 
something has to read the events to get them out.

-Steve

Re: Clear kernel audit buffer?

[Richard Guy Briggs]

On 14/01/14, Steve Grubb wrote:
> On Tuesday, January 14, 2014 01:09:52 PM Aaron Lewis wrote:
> > Yes, I did run auditctl -D to clear all rules. And during testing I
> > have enlarged the buffer queue to 10240 messages.
> > 
> > Did you mean that once -D is issued, the buffer will be cleared by
> > auditd, but not by linux kernel?
> 
> There is no way to directly clear the in kernel buffer. The audit system is 
> supposed to keep events for disposition. If there was a simple command to dump 
> events, that would be a simple way to circumvent detection. So, the best way 
> to drain the queues is to give auditd more priority so it runs more often and 
> longer before its time slice is up. You don't need to log to disk. But 
> something has to read the events to get them out.

What Steve said.

The -D option has nothing directly to do with the queue.  It simply
shuts off most of the the taps filling your sink.  You still need to
drain the sink after it has filled/overflowed.

> -Steve

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545