Cooked audit log format

[Matthew Booth <mbooth@redhat.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1520 bytes --]

As recently mentioned, Linux audit logs[1] are fairly hideous, and 
although machine readability may have been a design goal, I'd argue 
they're not too friendly in that regard either. I suspect, in fact, that 
the principal driver has been machine producability ;)

I've noticed that a number of utilities cook the logs slightly. I've 
shied away from this to date because I want to be able to leverage 
existing tools. However, if some standard emerged (or has emerged and I 
missed it) for cooked logs, I'd be extremely interested in implementing 
that.

Simple starters would include:
* Translating the architecture and syscall names into human.
* Jumping one way or the other with the hex strings business.
* Translating socket addresses into human.
* Translating timestamps into human.
* Ditching uninteresting records, such as PATH with no name for the 
dynamic linker, and 2 PATH records when execing a script.

with an ultimate goal of:
* Defining an expected set of data for every system call and putting 
them all on a single line in a well defined format.

Is anybody doing any work in this direction?

Matt

[1] Of course, they're really accounting logs produced by the accounting 
daemon. If you actually audit your accounting logs, this seemingly 
pedantic point can become quite confusing.
-- 
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]