From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: How to monitor audit/audispd killed Date: Mon, 04 Jan 2016 14:43:44 -0500 Message-ID: <2955652.6SqtRXJnWL@x2> References: <4152899.8YOsTRPv25@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Matthew Chao Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday, January 05, 2016 03:29:31 AM Matthew Chao wrote: > >You have a race condition where auditd gets a signal to shutdown and an > event indicating that shutdown is occurring. On shutdown, the audit daemon > does not alter the rules or whether auditing is enabled. (This was to get > shutdown AVCs for selinux.) There is a chance that your event is in syslog's > files. > > For clarity, I am still not sure whether audit rules can be written to > monitor auditd/auispd killed or not (syslog was disabled under my > circumstances ). You cannot audit the audit daemon's pid. Otherwise servicing an event could create several more events which cause even more and you get an exponential increase in logging until it dies. You can watch audispd, but I don't think that will help anything. > If yes, could you give me some tips? Thanks. The audit daemon is required to log some information about why it shutdown. If you have a daemon_end event, this is the required information. Is there something not in the event that you need? -Steve