Re: audit collector startup help

LC Bruzenak
2008-09-12T23:41:03Z

On Fri, 2008-09-12 at 16:33 -0400, DJ Delorie wrote:
> > So any clue as to why I get a "bad magic number" on this version?
>
> Nope. It means the server sent back a header that was corrupt, or
> sent back something other than a header.
>
> The header is defined in lib/private.h

After looking at this I had a hunch - the collector machine is 32-bit,
the sender 64-bit.

I reverse the sender/collector and I don't get this error anymore.
The machine architecture is not representative of the intended final
deployment, just the available machines I was using to test.

So now the bad news is that I still do not see events passing from
sender to collector. This may be to an incorrect assumption on my part.
I assume that all events on the sender make it to the collector. Is this
true always? I send in a forced event (on the sender):

[root@fryspc audisp]# auditctl -m TEST
[root@fryspc audisp]# ausearch -ts recent -i | grep TEST
type=USER msg=audit(09/12/2008 18:34:34.930:126) : user pid=4866 uid=root auid=root ses=11 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 msg='TEST: exe=/sbin/auditctl (hostname=?, addr=?, terminal=pts/2 res=success)'

But I cannot see this event on the collector.

The good news is that I see the connection on both ends (using port 1237=tsdos, lsof results):
collector:
auditd 9422 root 11u IPv4 55889 TCP comms:tsdos390->fryspc:55303 (ESTABLISHED)
collector:
sender:
audisp-re 4846 root 3u IPv4 26741 TCP fryspc:55303->192.168.31.142:tsdos390 (ESTABLISHED)

Should I see this event, and if so, do you have any idea as to why I do
not? I also have the same thing from another 64-bit sender.

Thx,