Re: Audit Prelude Logout Tracking

Steve Grubb
2009-02-19T14:36:10Z

On Thursday 19 February 2009 09:26:28 am Dan Gruhn wrote:
> Although this seemed like the right place to look, I don't see
> USER_LOGOUT events in my audit logs,

They are not used. I decided later that it was not needed for analysis. When
you login, there is always a session open event (user_start). This is
associated with a user_login event. So, when you see the session closed event
(user_end), the logout has occurred.

However...what if gdm dies? What if the kernel oopses? You have no ending
marker. So, what I did recently was patch upstart so that it logs system boot
& shutdown events. This way you can tell when the system malfunctioned. The
logic for the analysis is in the aulast program, which is in 1.7.11. However,
you don't have a patched upstart daemon for RHEL5 since it uses the older
SysVinit package.

One thing to note, preikka/prelude is an IDS system. Not all audit events are
IDS events. Only a handful really qualify as Intrusion Detection worthy. So,
you really can't use prewikka as an audit log browser.

-Steve