From mboxrd@z Thu Jan  1 00:00:00 1970
From: Robert Evans <bob.evans@jhuapl.edu>
Subject: Why aren't SYSCALLS being logged in CentOS kernel (any ideas?)
Date: Fri, 31 Aug 2007 11:40:07 -0400
Message-ID: <46D83657.1060503@jhuapl.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31])
	by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l7VFeSN8028198
	for <linux-audit@redhat.com>; Fri, 31 Aug 2007 11:40:28 -0400
Received: from jhuapl.edu (pilot.jhuapl.edu [128.244.198.200])
	by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l7VFeQt2021331
	for <linux-audit@redhat.com>; Fri, 31 Aug 2007 11:40:26 -0400
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Hi,

I'm using CentOS, kernel 2.6.18-8.el5.  I've compiled audit-1.5.6-1 and I'm 
getting USER_AUTH events (logins, su, etc...) but I'm not seeing any syscall events.

My test audit.rules works fine in RHEL4, Suse10 and Fedora, but doesn't seem to 
generate any syscall events in CentOS 5.  For testing purposes, I'm using the 
following in audit.rules:

# Log execute failures
-a exit,always -S execve -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F 
exit!=-6

# Log administrative functions
-a exit,always -S reboot -S clock_settime -S settimeofday -S adjtimex -S 
setdomainname -S sethostname -S reboot -S mount -S umount2
-a exit,always -S swapon -S swapoff -S create_module -S delete_module -S 
quotactl -F success!=1

# Log Read/Write functions
-a exit,always -S open -S creat -S link -S symlink -S truncate -S ftruncate -S 
mknod -S rename -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6

# Log file removal failures
-a exit,always -S unlink -S rmdir -F success!=1 -F exit!=-2 -F exit!=-20 -F 
exit!=-17 -F exit!=-6

# Log file modification failures
-a exit,always -S chmod -S chown -S lchown -S fchmod -S fchown -F success!=1 -F 
exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6

# Add watches for reboot stuff...
-w /sbin/init -p x -k runlevel
-w /sbin/telinit -p x -k runlevel
-w /sbin/halt -p x -k runlevel
-w /sbin/poweroff -p x -k runlevel
-w /sbin/reboot -p x -k runlevel
-w /sbin/shutdown -p x -k runlevel

Any ideas?

Bob