From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Disabling local logging with write_logs = no Date: Mon, 03 Dec 2018 10:17:59 -0500 Message-ID: <1935503.sbb2Ay52bZ@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, December 3, 2018 2:13:43 AM EST Kay Mccormick wrote: > I am trying to log only to a remote machine so I have set: > > write_logs = no > > in my auditd.conf. Unfortunately, when I restart auditd it does not appear > to respect my configuration choice. Accoring to your output, you are running auditd-2.6.7. It has this known bug: https://bugzilla.redhat.com/show_bug.cgi?id=1382397 > When I run it with 'auditd -f' to keep it in the foreground, it does not > write the file and i see : > > write_logs_parser called with: no > in the output. > > Looking at the source, I see: > > if (opt_foreground) { > config.daemonize = D_FOREGROUND; > set_aumessage_mode(MSG_STDERR, DBG_YES); > } else { > config.daemonize = D_BACKGROUND; > set_aumessage_mode(MSG_SYSLOG, DBG_NO); > (void) umask( umask( 077 ) | 022 ); > } > > It seems I cannot get messages logged with LOG_DEBUG without running in > foreground mode (in which case the bug does not appear to be triggered) or > recompiling auditd. Generally you do not need the debug messages because if auditd has any real problems it writes to syslog. The debug are generally very low level details like parsing outcome for the config file. > I have included the output of auditd -f and also my auditd.conf. This output also shows that you have local_events = no. That means that it will not register with the kernel to receive local events. Normally this is used when you have auditd in a container and it does not have access to the kernel's audit interface. It allows auditd to run in a container to be an aggregating server for other audit daemons. That is probably not what you intended. To prevent writing to logs, then you would set write_logs = no. However, the old version you are running has a bug. You'll need to upgrade to a newer version of auditd. There have been many bugfixes and improvements since 2.6.7. Also, if you are doing remove logging, you probably want to be using the enriched data format. This is achieved by setting log_format = ENRICHED. This collects local information and adds it to the event so remote systems can make sense of the events where uid/gid changes between machines. Hope this helps... -Steve