Re: [PATCH] auvirt: a new tool for reporting events related to virtual machines

[Steve Grubb <sgrubb@redhat.com>]

On Monday, January 09, 2012 12:00:32 PM Marcelo Cerri wrote:
> Just another question.
> 
> Currently, auvirt has two different modes defined by the options
> "--summary" and "--raw". In your last email, you suggested that summary
> would be laid out like the aulast program.

Yeah, I was thinking of something like a timeline so that you can what happened 
to resources and in what order. It just so happens aulast is also a time line of 
system boots and logins. When it comes to a virt guest, I would want to see it 
boot, things assigned, things removed, anything funny happening to it, and then 
it shutting down. I also think the host being booted/shutdown might ought to be 
in there, too.


> Do you think that would be a good idea to have a option to output all the
> matched records, as in "--raw", but using a layout similar to aulast too?

I think you want both a concise report and the ability to pull the just records 
that made up the report. Aulast does this by having a proof mode that instead of 
giving you the records, it tells you how to pull them with ausearch.

-Steve


> On 01/05/2012 02:44 PM, Marcelo Cerri wrote:
> > Hi Steve,
> > 
> > Thanks for you feedback.
> > 
> > I'm already updating the source code based on your comments and
> > looking for another events that may be correlated to a VM.
> > 
> > But I'm not sure what means "anomaly events". Would it be malformed
> > records (without some fields, for example) or a specific record type
> > generated by the kernel or some other userspace application?
> > 
> > Regards,
> > Marcelo
> > 
> > On 12/20/2011 04:18 PM, Steve Grubb wrote:
> >> On Thursday, December 15, 2011 10:56:51 AM Marcelo Cerri wrote:
> >>> This patch adds a new tool to extract information related to virtual
> >>> machines from the audit log files. It can output a summary with
> >>> information about the number of events found with details by type of
> >>> record and operation. The tool can also output the filtered records as
> >>> found in the audit log.
> >>> 
> >>> Using the --avc option auvirt tries to correlate AVC records to the
> >>> guests
> >>> based on its security context. It's also possible to select records
> >>> related
> >>> to just one guest using the UUID or the guest name.
> >> 
> >> I'm wondering about this tool. It runs fine. But I thought you were
> >> wanting to do
> >> some more sophisticated analysis of events. For example this is the
> >> current
> >> output:
> >> 
> >> $ ./auvirt --file ../../../virt-audit.log
> >> Total records:      6
> >> Virt records:       6
> >> Resource records:   4
> >> Machine ID records: 1
> >> AVC records:        0
> >> 
> >> Operations:
> >>    Start:            1
> >>    Stop:             0
> >> 
> >> Considered time:
> >>    Start:            Tue Dec 20 09:33:01 2011
> >>    End:              Tue Dec 20 09:33:01 2011
> >> 
> >> This is not much different than what can be reported by
> >> ausearch/report with the
> >> new uuid and vm search fields. Also, testing with the uuid number
> >> doesn't seem to
> >> get any hits. But using the vm name does.
> >> 
> >> I plan to add a very basic virt report to aureport soon. I was
> >> wondering if the
> >> above is all anyone really wanted to see? I would think that perhaps
> >> you want
> >> some info about start/stop assignment of resources, changes in
> >> resources, and
> >> perhaps MAC or anomaly events related to a vm. But laid out like the
> >> aulast
> >> program.
> >> 
> >> boot  vm-name   time  (total runtime)
> >> resource  what-kind  old-value  new-value  time (total time assigned)
> >> avc   access-type  obj  results  time
> >> shutdown  vm-name  time
> >> 
> >> and there might be other audit events associated with a vm.
> >> 
> >> -Steve