Duplicate audit event IDs

Duplicate audit event IDs

[Steve Brueckner]

What might cause this?  At some point my event IDs got reset (they didn't
cycle that fast!).  I've been playing quite a bit with the audit system so
I'm not sure what caused it.  Possibilities include:

 - Restarting the auditd service
 - Rebooting the machine
 - Deleting the /var/log/audit/audit.log file

Or should this just plain not happen?  I'm on FC4 using kernel
2.6.12-1.1447_FC4xen0.  I'm afraid I can't easily upgrade at the moment
because I've build an entire system predicated on old versions of SELinux
and Xen.  

I also have a couple of other questions:

 - How large to audit event numbers get before they cycle back to zero?
 - Is there any way to have ausearch only the most recent audit log instead
of all logs?

[root@localhost audit]# ausearch -a 8412 
----
time->Wed Apr  5 14:57:12 2006
type=PATH msg=audit(1144263432.028:8412): item=0
name="/home/dev/.icons/crystalsvg/index.theme" flags=101  inode=1278228
dev=03:01 mode=040775 ouid=600 ogid=600 rdev=00:00
type=CWD msg=audit(1144263432.028:8412):  cwd="/home/dev"
type=SYSCALL msg=audit(1144263432.028:8412): arch=40000003 syscall=5
success=no exit=-2 a0=832d8e8 a1=0 a2=1b6 a3=83630e8 items=1 pid=1226
auid=4294967295 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600
sgid=600 fsgid=600 comm="metacity" exe="/usr/bin/metacity"
----
time->Wed Apr  5 15:30:44 2006
type=PATH msg=audit(1144265444.562:8412): item=0
name="/home/dev/.Xauthority-c" flags=310  inode=1278085 dev=03:01
mode=040775 ouid=600 ogid=600 rdev=00:00
type=CWD msg=audit(1144265444.562:8412):  cwd="/home/dev"
type=SYSCALL msg=audit(1144265444.562:8412): arch=40000003 syscall=5
success=yes exit=2 a0=bfae17d3 a1=c1 a2=180 a3=bfae1f10 items=1 pid=1573
auid=4294967295 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600
sgid=600 fsgid=600 comm="xauth" exe="/usr/X11R6/bin/xauth"

Thanks,

Steve Brueckner, ATC-NY

Re: Duplicate audit event IDs

[Steve Grubb]

On Thursday 06 April 2006 10:47, Steve Brueckner wrote:
> What might cause this?

The event ID can be recycled. Its the combination of time stamp and serial 
number that creates uniqueness.

> At some point my event IDs got reset (they didn't cycle that fast!).  I've
> been playing quite a bit with the audit system so I'm not sure what caused
> it.  Possibilities include: 
>
>  - Restarting the auditd service

Nope

>  - Rebooting the machine

Yep

>  - Deleting the /var/log/audit/audit.log file

Nope

There can also be wrapping.

> Or should this just plain not happen?  

It can happen.

> I'm on FC4 using kernel 2.6.12-1.1447_FC4xen0.  I'm afraid I can't easily
> upgrade at the moment because I've build an entire system predicated on old
> versions of SELinux and Xen.

You will likely have other problems on a kernel that old. I think 2.6.14 was 
when we really had most features in place and stable.

> I also have a couple of other questions:
>
>  - How large to audit event numbers get before they cycle back to zero?

I think its a u32 number.

>  - Is there any way to have ausearch only the most recent audit log instead
> of all logs?

Sure, use the "-if" option and give it the full path to the file.

ausearch -if /var/log/audit/audit.log

-Steve