PATCH: ausearch doesn't correcly act as a filter when no EOF on input

PATCH: ausearch doesn't correcly act as a filter when no EOF on input

[Tony Jones]

This was filed as a bug in our bugzilla.

works : cat /var/log/audit/audit.log | ausearch -i -if /dev/stdin | cat
doesnt: tail -f /var/log/audit/audit.log | ausearch -i -if /dev/stdin | cat

Obviously it's a contrived example, they have more interesting processes each
side of the filter.   Issue is that tail -f never indicates EOF and if ausearch
stdout is a pipe (versus a file), the output can remain queued in the pipebuf.

Following patch fixes it, or a simpler patch could unconditionally flush stdout.

I've not looked for similar issues elsewhere.

Tony


--- ausearch.c.old	2008-11-17 15:55:47.000000000 -0800
+++ ausearch.c	2008-11-17 16:06:54.000000000 -0800
@@ -58,11 +58,11 @@
 extern int match(llist *l);
 extern void output_record(llist *l);
 
-static int input_is_pipe(void)
+static int is_pipe(int fd)
 {
 	struct stat st;
 
-	if (fstat(0, &st) == 0) {
+	if (fstat(fd, &st) == 0) {
 		if (S_ISFIFO(st.st_mode)) 
 			pipe_mode = 1;
 	}
@@ -92,7 +92,7 @@
 		rc = process_file(user_file);
 	else if (force_logs)
 		rc = process_logs();
-	else if (input_is_pipe())
+	else if (is_pipe(0))
 		rc = process_stdin();
 	else
 		rc = process_logs();
@@ -175,6 +175,7 @@
 {
 	llist entries; // entries in a record
 	int ret;
+	int flush = is_pipe(1);
 
 	/* For each record in file */
 	list_create(&entries);
@@ -185,6 +186,8 @@
 		}
 		if (match(&entries)) {
 			output_record(&entries);
+			if (flush) 
+				fflush(stdout);
 			found = 1;
 			if (just_one) {
 				list_clear(&entries);

Re: PATCH: ausearch doesn't correcly act as a filter when no EOF on input

[Steve Grubb]

On Monday 17 November 2008 19:17:54 Tony Jones wrote:
> Issue is that tail -f never indicates EOF and if ausearch stdout is a pipe
> (versus a file), the output can remain queued in the pipebuf.

The general problem is a little bigger. ausearch can't tell when an event is 
complete. It assumes that the kernel serializes things - which it doesn't. 
With files, it flushes everything when it hits EOF. But pipes don't have 
that. The solution I was going to implement was to start a timer when the 
input is a pipe and timeout the currently accumulating event. Flushing the 
output if using a pipe looks like a good measure, too.


> Following patch fixes it, or a simpler patch could unconditionally flush
> stdout.

I'd rather not flush all the time otherwise the performance improvement of 
buffering is lost. I currently have ausearch completely tore apart to rework 
its event collection logic so that interlaced events are assembled correctly 
and completely. Maybe in a few days I can revisit this problem.


> I've not looked for similar issues elsewhere.

aureport shares much of the same IO design and the auparse library also does 
not use clock time to finish off events if the input is a pipe.

-Steve

Re: PATCH: ausearch doesn't correcly act as a filter when no EOF on input

[Steve Grubb]

On Monday 17 November 2008 19:17:54 Tony Jones wrote:
> Issue is that tail -f never indicates EOF and if ausearch
> stdout is a pipe (versus a file), the output can remain queued in the
> pipebuf.

Applied in commit #190.

-Steve