From: Steve Grubb <sgrubb@redhat.com>
To: Mateusz Piotrowski <0mp@freebsd.org>
Cc: linux-audit@redhat.com, Konrad Witaszczyk <def@freebsd.org>
Subject: Re: Questions about the standard (Google Summer of Code Project)
Date: Thu, 14 Jul 2016 12:38:04 -0400 [thread overview]
Message-ID: <2341682.2D2kp868Cd@x2> (raw)
In-Reply-To: <B63FF289-BB62-4A41-90E6-7297851B7370@FreeBSD.org>
On Thursday, July 14, 2016 6:10:00 PM EDT Mateusz Piotrowski wrote:
> Hello,
>
> Thank you for your reply! It is absolutely amazing. It clarified a lot.
>
> >> b) Why do some records are separated by a comma and a
> >>
> >> whitespace? Example:
> >> type=DAEMON_START msg=audit(1363713609.192:5426): auditd
> >> start, ver=2.2 format=raw kernel=2.6.32-358.2.1.el6.x86_64
> >> auid=500 pid=4979 subj=unconfined_u:system_r:auditd_t:s0
> >> res=success
> >
> > A long time ago the records were meant to be both human readable (don't
> > laugh) and machine consumable. Over time these have been converted
> > name=value pairs. Even the one you mention above has been fixed.
>
> I am not sure if I understood; does it mean that: `auditd start, ver=2.2` is
> outdated and deprecated? I’m confused because Debian did produced a log
> file with this element.
Every time that I find something that doe not conform to name=value, I change
it or submit a patch. The current output is:
type=DAEMON_START msg=audit(1468495169.149:9305): op=start ver=2.6.5
format=enriched kernel=4.6.3-300.fc24.x86_64 auid=4294967295 pid=987
subj=system_u:system_r:auditd_t:s0 res=success\x1dAUID="unset"
Audit 2.2 is from March 2012. That is pretty old now.
Also notice that this event is in the enriched format. Auparse also hides that
fact so that you don't need to worry about it. If you write your own parser,
you'll need to handle both formats.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2016-07-14 16:38 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-13 11:23 Questions about the standard (Google Summer of Code Project) Mateusz Piotrowski
2016-07-13 14:23 ` Steve Grubb
2016-07-14 16:10 ` Mateusz Piotrowski
2016-07-14 16:38 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2341682.2D2kp868Cd@x2 \
--to=sgrubb@redhat.com \
--cc=0mp@freebsd.org \
--cc=def@freebsd.org \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox