From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] auvirt: a new tool for reporting events related to virtual machines Date: Wed, 11 Jan 2012 16:48:46 -0500 Message-ID: <201201111648.46860.sgrubb@redhat.com> References: <1323964611-30053-1-git-send-email-mhcerri@linux.vnet.ibm.com> <4F05D389.8090808@linux.vnet.ibm.com> <4F0B1D30.7070900@linux.vnet.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4F0B1D30.7070900@linux.vnet.ibm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Marcelo Cerri Cc: linux-audit@redhat.com, gcwilson@us.ibm.com, bryntcor@us.ibm.com List-Id: linux-audit@redhat.com On Monday, January 09, 2012 12:00:32 PM Marcelo Cerri wrote: > Just another question. > > Currently, auvirt has two different modes defined by the options > "--summary" and "--raw". In your last email, you suggested that summary > would be laid out like the aulast program. Yeah, I was thinking of something like a timeline so that you can what happened to resources and in what order. It just so happens aulast is also a time line of system boots and logins. When it comes to a virt guest, I would want to see it boot, things assigned, things removed, anything funny happening to it, and then it shutting down. I also think the host being booted/shutdown might ought to be in there, too. > Do you think that would be a good idea to have a option to output all the > matched records, as in "--raw", but using a layout similar to aulast too? I think you want both a concise report and the ability to pull the just records that made up the report. Aulast does this by having a proof mode that instead of giving you the records, it tells you how to pull them with ausearch. -Steve > On 01/05/2012 02:44 PM, Marcelo Cerri wrote: > > Hi Steve, > > > > Thanks for you feedback. > > > > I'm already updating the source code based on your comments and > > looking for another events that may be correlated to a VM. > > > > But I'm not sure what means "anomaly events". Would it be malformed > > records (without some fields, for example) or a specific record type > > generated by the kernel or some other userspace application? > > > > Regards, > > Marcelo > > > > On 12/20/2011 04:18 PM, Steve Grubb wrote: > >> On Thursday, December 15, 2011 10:56:51 AM Marcelo Cerri wrote: > >>> This patch adds a new tool to extract information related to virtual > >>> machines from the audit log files. It can output a summary with > >>> information about the number of events found with details by type of > >>> record and operation. The tool can also output the filtered records as > >>> found in the audit log. > >>> > >>> Using the --avc option auvirt tries to correlate AVC records to the > >>> guests > >>> based on its security context. It's also possible to select records > >>> related > >>> to just one guest using the UUID or the guest name. > >> > >> I'm wondering about this tool. It runs fine. But I thought you were > >> wanting to do > >> some more sophisticated analysis of events. For example this is the > >> current > >> output: > >> > >> $ ./auvirt --file ../../../virt-audit.log > >> Total records: 6 > >> Virt records: 6 > >> Resource records: 4 > >> Machine ID records: 1 > >> AVC records: 0 > >> > >> Operations: > >> Start: 1 > >> Stop: 0 > >> > >> Considered time: > >> Start: Tue Dec 20 09:33:01 2011 > >> End: Tue Dec 20 09:33:01 2011 > >> > >> This is not much different than what can be reported by > >> ausearch/report with the > >> new uuid and vm search fields. Also, testing with the uuid number > >> doesn't seem to > >> get any hits. But using the vm name does. > >> > >> I plan to add a very basic virt report to aureport soon. I was > >> wondering if the > >> above is all anyone really wanted to see? I would think that perhaps > >> you want > >> some info about start/stop assignment of resources, changes in > >> resources, and > >> perhaps MAC or anomaly events related to a vm. But laid out like the > >> aulast > >> program. > >> > >> boot vm-name time (total runtime) > >> resource what-kind old-value new-value time (total time assigned) > >> avc access-type obj results time > >> shutdown vm-name time > >> > >> and there might be other audit events associated with a vm. > >> > >> -Steve