Re: [RFC] New ausearch output option & audit viewing in Spacewalk

[Joshua Roys <joshua.roys@gtri.gatech.edu>]

On 06/08/2009 01:12 PM, John Dennis wrote:
> Joshua Roys wrote:
>> Hello all.
>>
>> As part of developing an audit viewing "plugin"[1] to Spacewalk[2], I
>> wrote a small program to use libauparse to output (easily)
>> machine-parsable audit logs.  I think this functionality would be nice
>> to have in ausearch, and as such, wrote a patch for it.
>>
>> As well as reviewing this patch, I would like your feedback concerning
>> the Spacewalk audit plugin.  Any questions or constructive criticism is
>> welcome.
>
> Would you please post an example of the output and/or the parsing rules.
>
> Thanks
>

Basically the following:

type=USER_ACCT
serial=222
seconds=1244481001
milli=141
user pid=24777
uid=root
auid=unset
ses=4294967295
subj=system_u:system_r:crond_t:s0-s0:c0.c1023
op=PAM:accounting
acct=root
exe=/usr/sbin/crond
hostname=?
addr=?
terminal=cron
res=success
----
type=CRED_ACQ
serial=223
seconds=1244481001
milli=141
user pid=24777
uid=root
auid=unset
ses=4294967295
subj=system_u:system_r:crond_t:s0-s0:c0.c1023
op=PAM:setcred
acct=root
exe=/usr/sbin/crond
hostname=?
addr=?
terminal=cron
res=success
----
type=LOGIN
serial=224
seconds=1244481001
milli=141
login pid=24777
uid=root
old auid=unset
new auid=root
old ses=4294967295
new ses=34
----

Simply key=value with all nodes separated by "----\n".  I should note 
that the patch has not been exhaustively tested, it's more of a RFC and 
also a request for those more knowledgeable of the audit logs to improve 
upon it.

Thanks,

Joshua Roys