Re: Kernel audit output is inconsistent, hard to parse

[John Dennis <jdennis@redhat.com>]

Miloslav Trmac wrote:
> Hello,
> John Dennis napsal(a):
>> The current formatting of the record timestamp
>> (e.g. audit(ssss.mmm:iii) is inconsistent with
>> all other name/value pairs. It should be "seconds="sss"
>> milliseconds="mmm" serial="iii", this allows parsing to be regular and
>> consistent.
> Isn't this unnecessarily verbose?  Just
>    time="sss.mmm" serial="iii"
> would be smaller, easier to read - and it would allow using better time 
> precision in the future.

It's a reasonable argument. I can see value in either approach.

>> It's a judgment call over when and how to introduce change
>> and the anticipated impact.
> If this change is implemented, we should use the opportunity to clean up 
> other inconsistencies in audit messages - e.g. different messages use 
> "success", "res" and "result" fields to record whether the audited 
> operation was successful.
> 
> Also note that similar changes are necessary in user-space, e.g.
>   type=USER_ERR ...: ... msg='PAM: bad_ident acct=? : 
> exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
> contains name-value pairs within a value, using both pairs of quotes.

Excellent points. Thank you for drawing attention to these.

-- 
John Dennis <jdennis@redhat.com>