stopping "chatter"

stopping "chatter"

[Greg Hennessy]

[-- Attachment #1: Type: text/plain, Size: 939 bytes --]

I need to configure auditing for certification reasons, but I'd like to
cut down on wasted disk space by ignoring known "chatter". On a newly installed
Redhat 5 workstation there seems to be an open of /var/run/utmp every 10 seconds,
which fills the log files. I'd like to ignore these, but my first attempt doesn't
seem to work. I'm admittedly a novice at configuring auditd.

[root@foo ~]# aureport -f --summary | head -10

File Summary Report
===========================
total  file
===========================
136065  /var/run/utmp
5283  /etc/symc-defutils.conf
795  /home/fsotest/.gconf/apps/puplet/
662  /usr/include/linux/
599  /dev/null
[root@foo ~]# auditctl -l | grep utmp
[root@foo ~]# auditctl -a exit,never -w /var/run/utmp
[root@foo ~]# auditctl -l | grep utmp
LIST_RULES: exit,always watch=/var/run/utmp perm=rwxa
[root@foo ~]#

What would be the proper syntax to get auditctl to
ignore the open attempts to /var/run/utmp?


[-- Attachment #2: greg.hennessy.vcf --]
[-- Type: text/x-vcard, Size: 278 bytes --]

begin:vcard
fn:Greg Hennessy
n:Hennessy;Greg
org:USNO;Astrometry Department
adr:;;3450 Mass. Ave. NW;Washington;DC;20392;USA
email;internet:gsh@usno.navy.mil
title:Astronomer
tel;work:(202) 762-1523
tel;fax:(202) 762-1514
url:http://ad.usno.navy.mil/~gsh
version:2.1
end:vcard


[-- Attachment #3: Type: text/plain, Size: 0 bytes --]

Re: stopping "chatter"

[Steve Grubb]

On Friday 02 November 2007 04:30:33 pm Greg Hennessy wrote:
> 136065  /var/run/utmp
>
> What would be the proper syntax to get auditctl to
> ignore the open attempts to /var/run/utmp?

The audit system would not normally record access to that file unless it was 
told to. Do you see a rule that is watching that file? If so, comment it out 
or modify the rule so that it only watches for more unusual accesses like 
accessing it when there's a permission denied something like:

auditctl -a exit,always -F exit=-13 -F perm=wra -F path=/var/run/utmp

-Steve