From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bill Tangren Subject: wierd audit problems on one RHEL ES4 box Date: Thu, 12 Apr 2007 10:08:38 -0400 Message-ID: <461E3D66.8060508@usno.navy.mil> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l3CE8fiI021954 for ; Thu, 12 Apr 2007 10:08:41 -0400 Received: from [198.116.61.254] (beatrix.usno.navy.mil [198.116.61.254]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l3CE8dd6013561 for ; Thu, 12 Apr 2007 10:08:39 -0400 Received: from [10.1.5.58] (mach2.usno.navy.mil [10.1.5.58]) by aa.usno.navy.mil (Postfix) with ESMTP id 6FEB0205694 for ; Thu, 12 Apr 2007 10:08:38 -0400 (EDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit List-Id: linux-audit@redhat.com I just implemented a new rule set for auditing, and now the audit daemon won't start. It died a few hours before the logs were due to be rotated. Even though the auditd is dead, auditing is still being done, but the output is going to /var/log/messages, NOT to /var/log/audit, as before. When I did a service auditd status I got a auditd locked, but pid exists message. I tried to start it, but it wouldn't start. I rebooted, and it wouldn't come back up. I changed back to the old rule set and tried to restart. No joy. I rebooted again. It failed on start up. This is the rule set I tried: # First rule - delete all -D # Feel free to add below this line. See auditctl man page # Increase the buffers to survive stress events -b 256 -e 1 # Audit Failed opens -a exit,always -S open -F success!=0 # # Audit success and failure of delete -a exit,always -S unlink -S rmdir # # Audit success and failure of admin actions #-a task,always -F uid=0 -w /var/log/audit/ -k ADMIN -w /etc/auditd.conf -k ADMIN -w /etc/audit.rules -k ADMIN -a exit,always -S stime -S acct -S reboot -S swapon -S settimeofday -S setrlimit -a exit,always -S setdomainname -S sched_setparam -S sched_setscheduler # # Audit success and failure of login/logout # on by default with update 4. # # Audit sucess and failure of permissions -a entry,possible -S chmod -S fchmod -S chown -S chown32 -S fchown -S fchown32 -S lchown -S lchown32 I don't know whether or not this rule set is an issue, but the change and the problems occurred at about the same time. This is what I have in my auditd.conf: log_file = /var/log/audit/audit.log log_format = RAW priority_boost = 3 flush = SYNC freq = 0 num_logs = 15 max_log_file = 95 max_log_file_action = ignore space_left = 75 space_left_action = SYSLOG action_mail_acct = root admin_space_left = 50 admin_space_left_action = SUSPEND disk_full_action = SUSPEND disk_error_action = SUSPEND When I try to restart the auditd, no error messages I can see show up in /var/log/messages. I've implemented these rules on other RHEL ES 4 boxes, without problems. Any ideas what is wrong?