From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: How to monitor audit/audispd killed Date: Tue, 05 Jan 2016 12:48:39 -0500 Message-ID: <2051384.UMDlMJSUJC@x2> References: <5861142.vTemG0RS1M@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Matthew Chao Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On Wednesday, January 06, 2016 12:12:54 AM Matthew Chao wrote: > In short, my question is: my program depends on audispd to dispatch audit > messages, for security's sake, when audispd is killed, how can I know it > happened in time in order to restart audispd? I think that you have to approach the problem from a different angle. As a child of audispd, you will probably get a SIGPIPE which if unhandled will cause termination. That said, your application can't really start audispd because auditd needs to in order to setup the pipes. Then audispd needs to start your plugin. But that raises to the question of are you seeing any problems that cause audispd to be killed? The reason I ask is that no one is reporting problems where either auditd or audispd are terminating due to a fault. But if you were just wanting to be careful, then you really ought to write a small program that its whole job is to start auditd and catch SIGCHLD. When you catch SIGCHLD, restart the audit daemon. If your watcher gets any signals such as SIGHUP/USR1/USR2/TERM, then pass them along to auditd. If you are on a system with systemd as the init system, it already has a Restart= option to restart a critical service if it shutsdown. That said, an admin can always shutdown the audit service if they want to. Are you having problems with audispd or just trying to be careful with a design? Hope this helps... -Steve > On Tuesday, January 5, 2016, Steve Grubb wrote: > > On Tuesday, January 05, 2016 06:08:54 PM Matthew Chao wrote: > > > >"You can watch audispd, but I don't think that will help anything. > > > > > > my program totally depends on audispd to dispatch audit messages. I > > > think > > > audispd need more robust mechanisms to monitor itself killed, otherwise > > > which inevitably leads to that audispd' plugins receive nothing but > > > > always > > > > > wait wait wait for event messages. > > > > > > So are there some alternative ways to monitor audispd killed in audit > > > ver1.8 ? > > > > To help you, I need to know more about what the actual problem is that you > > are > > trying to solve. Would you like to explain the problem so we can help > > figure > > out how to address it? > > > > Thanks, > > -Steve