Re: ENRICHED log_format not encoding all parameters

[Steve Grubb <sgrubb@redhat.com>]

On Thursday, July 20, 2017 4:06:48 AM EDT Peter KRIVANSKY wrote:
> Hello together,
> 
> I am writing to this mailing list as I have not found any working solution
> online.
> We use the audit with ENRICHED log_format, but we see lots of
> parameters not being decoded from HEX, Here are the auditd settings:

The decoding from hex is done by ausearch. Its always been like that. What the 
enriched format does is capture the ephemeral system specific mappings such as 
UID/GID at the moment the event occurs. This way the events can be correctly 
displayed by ausearch no matter which computer you run ausearch on.


> log_file = /var/log/audit/audit.log
> log_format = ENRICHED
> log_group = root
> priority_boost = 4
> flush = incremental
> freq = 6000
> num_logs = 10
> disp_qos = lossy
> dispatcher = /sbin/audispd
> name_format = hostname
> max_log_file = 30
> max_log_file_action = ROTATE
> space_left = 150
> space_left_action = SYSLOG
> action_mail_acct = root
> admin_space_left = 100
> admin_space_left_action = SUSPEND
> disk_full_action = SUSPEND
> disk_error_action = SUSPEND
> tcp_listen_queue = 5
> tcp_max_per_addr = 1
> tcp_client_max_idle = 0
> enable_krb5 = no
> krb5_principal = auditd
> 
> Installed audit Version:
> 2.6.5-3.el7_3.1
> 
> Here the problem parts of the Audit log (parameter a2):
> 
> node=hostname.domain.tld type=EXECVE msg=audit(1500536092.301:232170298):
> argc=3 a0="/bin/sh" a1="-c"
> a2=2F7573722F6C6F63616C2F6E6167696F732F6C6962657865632F636865636B5F6E727065
> 202D32202D482031302E3130302E3135302E313732202D702035363636202D6320436865636B
> 46696C6573202D74203230202D6120706174683D463A2F636C656172696E672F6D6366742F70
> 6F736569646F6E2F206D61782D6469722D64657074683D30207061747465726E3D2A33335F30
> 3535305F4C5F2A2E434B38202266696C7465723D7772697474656E206C74202D33306D20414E
> 442073697A652067742031306222204D6178437269743D31
 
> not decoded parameter (a14) in the middle:
> node= hostname.domain.tld  type=EXECVE msg=audit(1500536092.303:232170300):
> argc=16 a0="/usr/local/nagios/libexec/check_nrpe" a1="-2" a2="-H"
> a3="10.100.0.0" a4="-p" a5="5666" a6="-c" a7="CheckFiles" a8="-t" a9="20"
> a10="-a" a11="path=F:/clearing/mcft/poseidon/" a12="max-dir-depth=0"
> a13="pattern=*33_0550_L_*.CK8"
> a14=66696C7465723D7772697474656E206C74202D33306D20414E442073697A65206774203
> 13062 a15="MaxCrit=1"

> 
> We need ENRICHED log_formad so we can analyze audit logs on a central Log
> server. I tried to increase the „priority_boost“ parameter to 6, and
> increased the „freq“ param. to 6000 to give the auditd more time for
> decoding. 

It doesn't need more time as this does not any kind of deadline scheduler. I 
would however recommend using incremental_async for the flush method as its 
about 90x faster than the normal incremental method. But this won't affect the 
hex encoding. To see your event in full, you need to run the event through 
ausearch.


> None of the mentioned helped. What I don’t understand is that
> sometimes it’s the last parameters which is not decoded, and sometimes it
> one in the middle. 

The hex encoding is done whenever there is a field being captured that could 
be controlled by the user. This is to prevent someone naming a file that would 
confuse a naive parser and make it misparse the event.

> See example above 
> Any kind of advice is welcome
> With kind regards

Hope this helps...

-Steve

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit