From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: audit.rules not fully loading into memory according to auditctl -l
Date: Wed, 12 Apr 2017 17:01:46 -0400
Message-ID: <19138140.T3VnJrJFPz@x2>
References: <CAJdJdQmiE+2DAcD5sH0P1w+n0-PCgUMV-gXUYuPE7P3ieZe4zg@mail.gmail.com>
	<2058029.S3Qy87qqTn@x2>
	<CAJdJdQm3pPQZpfQNM+SQNu_6NKgz9TWXWunue89W8yHJhN_XgQ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <CAJdJdQm3pPQZpfQNM+SQNu_6NKgz9TWXWunue89W8yHJhN_XgQ@mail.gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: "warron.french" <warron.french@gmail.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday, April 12, 2017 3:00:59 PM EDT warron.french wrote:
> Yes, certainly.
> 
> I had a 1.7GB messages file in /var/log; so I moved it manually out of the
> way.  Then I rebooted.
> 
> After doing that, I didn't see anything at all about auditd in the new
> /var/log/messages.

It will probably be auditctl rather than auditd. Auditctl is noisy on any 
problems, try loading the rules by hand:

auditctl -R /etc/audit/audit.rules

-Steve

> I have finally gotten it down to 13 audit rules, all still Action Rules
> only for some reason, that are not loading into memory from
> /etc/audit/audit.rules.
> Those action rules are using -F path= attributes.
> 
> What is really interesting is that I have other action rules using -F path=
> that are getting into memory!
> 
> These are the files that are not:
> /usr/libexec/kde4/kdesud
> /usr/libexec/openssh/ssh-keysign
> /usr/libexec/polkit-1/polkit-agent-helper-1
> /usr/libexec/pt_chown
> /usr/libexec/utempter/utempter
> /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
> /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
> /usr/sbin/lockdev
> /usr/sbin/postdrop
> /usr/sbin/postqueue
> /usr/sbin/suexec
> /usr/sbin/userhelper
> /usr/sbin/usernetctl
> 
> I did the following to evaluate---
> for FIL in `cat audit_action_rules_File | grep -v "^#" | awk '{ print $4 }'
> 
> | cut -d= -f 2`; do
> 
>    echo "Checking for ${FIL}."
>    if [ -f ${FIL} ]; then
>       echo "${FIL} is present."
>    else
>       echo "The file ${FIL} is not present."
>    fi
> done