From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: ABI guarantee for auditd Date: Fri, 16 Jan 2015 08:48:03 -0500 Message-ID: <1952249.ljydSPkMKP@x2> References: <3fbf5caa9cacbccadda7623eabadbc05@thefroid.net> <3567295.SZ2jdmf0NG@x2> <67f972dd606a13a87560d389463a5390@thefroid.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <67f972dd606a13a87560d389463a5390@thefroid.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday, January 15, 2015 06:20:41 PM hsultan@thefroid.net wrote: > Thanks for the info, so I tried using libauparse (again, Ubuntu 14.04 > LTS), however I'm hitting something truly weird: once I've adddd the > event parsing code (taken from > https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.c > ) and added -lauparse, what I get out of audit_get_reply now is > mangled. Why are you using that in an analytical program? That is a very low level function for getting events out of the kernel. You might want to have a look at this presentation to understand the audit architecture: http://people.redhat.com/sgrubb/audit/audit_ids_2011.pdf Auditd handles getting events from the kernel, passes them to audispd, you have a plugin to audispd and get the event in realtime. If you want events on disk, you just tell auparse_init that you want to use the logs as your source. Libauparse handles events after they have been processed by auditd. > That clearly can't be a code mistake because I didn't touch the event > retrieval code, It is a mistake. The example code works and demonstrates how to get events and iterate over the records and fields of the record. The presentation mentioned above also shows how to iterate over events, records, and fields. It also has a UML diagram to orient a developer to the data abstractions. > Is there a conflict or some specific setup between the 2 libraries I > should know about ? No. Auparse needs to be linked against libaudit for syscall lookup functions and a couple other items. > Does libauparse configures the audit infrastructure > in the kernel somehow ? No. Its used for post-processing audit events. Its not meant for grabbing events out of the audit netlink socket. Its expects events that are properly formatted. -Steve