Re: Disabling local logging with write_logs = no

[Steve Grubb <sgrubb@redhat.com>]

On Monday, December 3, 2018 2:13:43 AM EST Kay Mccormick wrote:
> I am trying to log only to a remote machine so I have set:
> 
> write_logs = no
> 
> in my auditd.conf. Unfortunately, when I restart auditd it does not appear
> to respect my configuration choice.

Accoring to your output, you are running auditd-2.6.7. It has this known bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1382397


> When I run it with 'auditd -f' to keep it in the foreground, it does not
> write the file and i see :
> 
> write_logs_parser called with: no
> in the output.
>
> Looking at the source, I see:
> 
>         if (opt_foreground) {
>                 config.daemonize = D_FOREGROUND;
>                 set_aumessage_mode(MSG_STDERR, DBG_YES);
>         } else {
>                 config.daemonize = D_BACKGROUND;
>                 set_aumessage_mode(MSG_SYSLOG, DBG_NO);
>                 (void) umask( umask( 077 ) | 022 );
>         }
> 
> It seems I cannot get messages logged with LOG_DEBUG without running in
> foreground mode (in which case the bug does not appear to be triggered) or
> recompiling auditd.

Generally you do not need the debug messages because if auditd has any real 
problems it writes to syslog. The debug are generally very low level details 
like parsing outcome for the config file.

> I have included the output of auditd -f and also my auditd.conf.

This output also shows that you have local_events = no. That means that it 
will not register with the kernel to receive local events. Normally this is 
used when you have auditd in a container and it does not have access to the 
kernel's audit interface. It allows auditd to run in a container to be an 
aggregating server for other audit daemons. That is probably not what you 
intended.

To prevent writing to logs, then you would set write_logs = no. However, the 
old version you are running has a bug. You'll need to upgrade to a newer 
version of auditd. There have been many bugfixes and improvements since 2.6.7.

Also, if you are doing remove logging, you probably want to be using the 
enriched data format. This is achieved by setting log_format = ENRICHED. This 
collects local information and adds it to the event so remote systems can 
make sense of the events where uid/gid changes between machines.

Hope this helps...

-Steve