Using Audit to create a realtime process creation monitor

Using Audit to create a realtime process creation monitor

[Bruno Gustavo Wallauer]

Hi All,

I'm working on a system that needs a realtime process creation tool
(using C programming), getting the pid ppid and path of the process.

I've been trying to use the audit subsystem to do this, but no matter
which way I tried, so far I hadn't been successful.

I've tried these for task creation:

    - auditctl -a entry,always -S fork -S vfork -S clone
            This way I can't know the pid of the new process, just the
caller;
    - auditctl -a entry,always -S brk -F 'a0=0'
             This way works most of the time, but creates duplicated
entries;
    - auditctl -a task,always
             With this I get _a lot_ of garbage, and it's too CPU
consuming to process the output;


And this for task destruction:

    - auditctl -a entry,always -S exit -S exit_group
             Works most of the time, but doesn't catch "killall sshd"
(doesn't get the "sshd is dying" part).

    Can anybody help me with these?

    Thanks in advance.

    Cheers,

Bruno Gustavo Wallauer

Re: Using Audit to create a realtime process creation monitor

[Steve Grubb]

On Friday 24 October 2008 18:43:34 Bruno Gustavo Wallauer wrote:
> I'm working on a system that needs a realtime process creation tool
> (using C programming), getting the pid ppid and path of the process.

Should be possible, but it requires a kernel patch to really be right. I think 
the patch is landing in the RHEL5.3 kernel and 2.6.28. What it does is gives 
2 event records on fork/clone.


> I've been trying to use the audit subsystem to do this, but no matter
> which way I tried, so far I hadn't been successful.
>
> I've tried these for task creation:
>
>     - auditctl -a entry,always -S fork -S vfork -S clone
>             This way I can't know the pid of the new process, just the
> caller;

This rule should do it. That is what the kernel patch fixes. You would get 2 
records now. This was fixed under, bz#461831


> And this for task destruction:
>
>     - auditctl -a entry,always -S exit -S exit_group
>              Works most of the time, but doesn't catch "killall sshd"
> (doesn't get the "sshd is dying" part).

Some tasks exit in a strange way. Have you tried stracing sshd to see how it 
exits?

-Steve