From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: MAC_IPSEC_EVENT Logged without rules
Date: Mon, 9 Jan 2012 11:46:15 -0500 [thread overview]
Message-ID: <201201091146.16206.sgrubb@redhat.com> (raw)
In-Reply-To: <CAA7Uhc=FLnwShGFx51yinXsrgPhKxkKrrkK-Nwv=PJGsCKryMw@mail.gmail.com>
On Thursday, January 05, 2012 10:26:10 PM Diego Woitasen wrote:
> Hi,
> I have a machine with IPSEC running (Strongswan) and audit to
> register some user events. The weird thing is that I'm getting this
> messages logged without having any rule:
>
> Jan 6 00:21:43 nodovpn668 audispd: node=nodovpn668
> type=MAC_IPSEC_EVENT msg=audit(1325820103.059:2953): op=SA-notfound
> src=172.16.0.59 dst=172.16.0.181 spi=2351148309(0x8c23ad15)
> seqno=1463943698
>
> My workaround is: auditctl -a exclude,always -F msgtype=MAC_IPSEC_EVENT
>
> Bug or Am I missing something?
This is correct. There are 2 kinds of events: mandatory and discretionary. There
are a number of user space and kernel events that are generated no matter what,
like a user logging into a machine. But there are also some events that the
admin may not want and they need to be excluded. So, adding an exclude rule is
the right thing to do if you don't want them.
-Steve
prev parent reply other threads:[~2012-01-09 16:46 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-06 3:26 MAC_IPSEC_EVENT Logged without rules Diego Woitasen
2012-01-09 16:46 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201201091146.16206.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox