* space_left_action=exec only works once?
@ 2017-01-25 23:06 Bond Masuda
2017-01-26 6:22 ` Steve Grubb
0 siblings, 1 reply; 6+ messages in thread
From: Bond Masuda @ 2017-01-25 23:06 UTC (permalink / raw)
To: linux-audit
Hello,
I configured space_left and space_left_action to run a script that
compresses and moves older audit log files from /var/log/audit. It
appears to work 1 time, and then doesn't work anymore until I kill the
auditd daemon and start it again.
Is this expected and/or desired behavior? I didn't see anything in the
man pages about this behavior. I was hoping to have my script run every
time the space_left threshold is hit so as to not run out of logging
disk space. Is there something I can do to accomplish this?
Thanks,
Bond
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: space_left_action=exec only works once?
2017-01-25 23:06 space_left_action=exec only works once? Bond Masuda
@ 2017-01-26 6:22 ` Steve Grubb
2017-01-26 19:38 ` Bond Masuda
2017-03-28 2:31 ` Steve Grubb
0 siblings, 2 replies; 6+ messages in thread
From: Steve Grubb @ 2017-01-26 6:22 UTC (permalink / raw)
To: Bond Masuda; +Cc: linux-audit
Hello,
On Wed, 25 Jan 2017 15:06:50 -0800
Bond Masuda <bond.masuda@jlbond.com> wrote:
> I configured space_left and space_left_action to run a script that
> compresses and moves older audit log files from /var/log/audit. It
> appears to work 1 time, and then doesn't work anymore until I kill
> the auditd daemon and start it again.
>
> Is this expected and/or desired behavior? I didn't see anything in
> the man pages about this behavior. I was hoping to have my script run
> every time the space_left threshold is hit so as to not run out of
> logging disk space. Is there something I can do to accomplish this?
You may need to send SIGUSR2 to `pidof auditd` to reset the internal
counters. Let me know if that does not fix it.
-Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: space_left_action=exec only works once?
2017-01-26 6:22 ` Steve Grubb
@ 2017-01-26 19:38 ` Bond Masuda
2017-01-26 20:08 ` Stephen Buchanan
2017-03-28 2:31 ` Steve Grubb
1 sibling, 1 reply; 6+ messages in thread
From: Bond Masuda @ 2017-01-26 19:38 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
Thanks Steve for the suggestion. Unfortunately, even with my script
sending USR2 to auditd, i still get the same behavior where the
space_left_action=exec call to the script only happens once.
Thoughts?
Bond
On 01/25/2017 10:22 PM, Steve Grubb wrote:
> Hello,
>
> On Wed, 25 Jan 2017 15:06:50 -0800
> Bond Masuda <bond.masuda@jlbond.com> wrote:
>> I configured space_left and space_left_action to run a script that
>> compresses and moves older audit log files from /var/log/audit. It
>> appears to work 1 time, and then doesn't work anymore until I kill
>> the auditd daemon and start it again.
>>
>> Is this expected and/or desired behavior? I didn't see anything in
>> the man pages about this behavior. I was hoping to have my script run
>> every time the space_left threshold is hit so as to not run out of
>> logging disk space. Is there something I can do to accomplish this?
> You may need to send SIGUSR2 to `pidof auditd` to reset the internal
> counters. Let me know if that does not fix it.
>
> -Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: space_left_action=exec only works once?
2017-01-26 19:38 ` Bond Masuda
@ 2017-01-26 20:08 ` Stephen Buchanan
2017-01-26 20:14 ` Bond Masuda
0 siblings, 1 reply; 6+ messages in thread
From: Stephen Buchanan @ 2017-01-26 20:08 UTC (permalink / raw)
To: Bond Masuda; +Cc: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 1562 bytes --]
My thought: If Steve is able to help you fix the behavior, then great.
Otherwise, pivot.
Instead of using the space_left_action in auditd, use logrotate and have it
check for max log size. Put your script in the postrotate section if more
logic than what is provided with logrotate is needed.
Stephen
On Thu, Jan 26, 2017 at 2:41 PM Bond Masuda <bond.masuda@jlbond.com> wrote:
> Thanks Steve for the suggestion. Unfortunately, even with my script
> sending USR2 to auditd, i still get the same behavior where the
> space_left_action=exec call to the script only happens once.
>
> Thoughts?
> Bond
>
>
> On 01/25/2017 10:22 PM, Steve Grubb wrote:
> > Hello,
> >
> > On Wed, 25 Jan 2017 15:06:50 -0800
> > Bond Masuda <bond.masuda@jlbond.com> wrote:
> >> I configured space_left and space_left_action to run a script that
> >> compresses and moves older audit log files from /var/log/audit. It
> >> appears to work 1 time, and then doesn't work anymore until I kill
> >> the auditd daemon and start it again.
> >>
> >> Is this expected and/or desired behavior? I didn't see anything in
> >> the man pages about this behavior. I was hoping to have my script run
> >> every time the space_left threshold is hit so as to not run out of
> >> logging disk space. Is there something I can do to accomplish this?
> > You may need to send SIGUSR2 to `pidof auditd` to reset the internal
> > counters. Let me know if that does not fix it.
> >
> > -Steve
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
[-- Attachment #1.2: Type: text/html, Size: 2878 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: space_left_action=exec only works once?
2017-01-26 20:08 ` Stephen Buchanan
@ 2017-01-26 20:14 ` Bond Masuda
0 siblings, 0 replies; 6+ messages in thread
From: Bond Masuda @ 2017-01-26 20:14 UTC (permalink / raw)
To: Stephen Buchanan; +Cc: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 2446 bytes --]
Thanks for the alternative Stephen. Actually, I already have one that
seems to work by using incrond to monitor for new log files in
/var/log/audit and running my script when a new log file appears. My
script searches for uncompressed logs that end in a audit.log.* and
compresses those and moves them. I have auditd set to keep_logs at 64MB
each. This seems to work in terms of keeping the /var/log/audit
partition space from filling up too much when we get lots of audit logs.
I plan to use this method unless the native auditd mechanism can be made
to work for this use case.
Bond
On 01/26/2017 12:08 PM, Stephen Buchanan wrote:
> My thought: If Steve is able to help you fix the behavior, then great.
> Otherwise, pivot.
>
> Instead of using the space_left_action in auditd, use logrotate and
> have it check for max log size. Put your script in the postrotate
> section if more logic than what is provided with logrotate is needed.
>
> Stephen
>
> On Thu, Jan 26, 2017 at 2:41 PM Bond Masuda <bond.masuda@jlbond.com
> <mailto:bond.masuda@jlbond.com>> wrote:
>
> Thanks Steve for the suggestion. Unfortunately, even with my script
> sending USR2 to auditd, i still get the same behavior where the
> space_left_action=exec call to the script only happens once.
>
> Thoughts?
> Bond
>
>
> On 01/25/2017 10:22 PM, Steve Grubb wrote:
> > Hello,
> >
> > On Wed, 25 Jan 2017 15:06:50 -0800
> > Bond Masuda <bond.masuda@jlbond.com
> <mailto:bond.masuda@jlbond.com>> wrote:
> >> I configured space_left and space_left_action to run a script that
> >> compresses and moves older audit log files from /var/log/audit. It
> >> appears to work 1 time, and then doesn't work anymore until I kill
> >> the auditd daemon and start it again.
> >>
> >> Is this expected and/or desired behavior? I didn't see anything in
> >> the man pages about this behavior. I was hoping to have my
> script run
> >> every time the space_left threshold is hit so as to not run out of
> >> logging disk space. Is there something I can do to accomplish this?
> > You may need to send SIGUSR2 to `pidof auditd` to reset the internal
> > counters. Let me know if that does not fix it.
> >
> > -Steve
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com <mailto:Linux-audit@redhat.com>
> https://www.redhat.com/mailman/listinfo/linux-audit
>
[-- Attachment #1.2: Type: text/html, Size: 5054 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: space_left_action=exec only works once?
2017-01-26 6:22 ` Steve Grubb
2017-01-26 19:38 ` Bond Masuda
@ 2017-03-28 2:31 ` Steve Grubb
1 sibling, 0 replies; 6+ messages in thread
From: Steve Grubb @ 2017-03-28 2:31 UTC (permalink / raw)
To: linux-audit
On Thursday, January 26, 2017 1:22:10 AM EDT Steve Grubb wrote:
> Hello,
>
> On Wed, 25 Jan 2017 15:06:50 -0800
>
> Bond Masuda <bond.masuda@jlbond.com> wrote:
> > I configured space_left and space_left_action to run a script that
> > compresses and moves older audit log files from /var/log/audit. It
> > appears to work 1 time, and then doesn't work anymore until I kill
> > the auditd daemon and start it again.
> >
> > Is this expected and/or desired behavior? I didn't see anything in
> > the man pages about this behavior. I was hoping to have my script run
> > every time the space_left threshold is hit so as to not run out of
> > logging disk space. Is there something I can do to accomplish this?
>
> You may need to send SIGUSR2 to `pidof auditd` to reset the internal
> counters. Let me know if that does not fix it.
I dug into this in detail today. I apologize for how long it took, but our QE
guy showed me how to reproduce this without losing a couple years of audit
logs I use for testing and research.
In any event, your script must send sigusr2 to the audit daemon the man page
documents this by saying to use "service auditd resume". SE Linux denies this
by default. So, you might have an AVC. I'll open a bz against selinux policy
to ask for allowance on this.
But I did find one issue. When there is an exec action, auditd really should
close its logging descriptor so that it's not writing to a deleted file. Then
on SIGUSR2, it should re-open the descriptor. This was pushed into git today.
So, the next release, which is tomorrow, will have a fix so that if your script
sends SIGUSR2, auditd should behave in a more supportive way.
Please test again once you have 2.7.4 and let me know if you have any
problems.
-Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-03-28 2:31 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-01-25 23:06 space_left_action=exec only works once? Bond Masuda
2017-01-26 6:22 ` Steve Grubb
2017-01-26 19:38 ` Bond Masuda
2017-01-26 20:08 ` Stephen Buchanan
2017-01-26 20:14 ` Bond Masuda
2017-03-28 2:31 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox