From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joshua Roys Subject: Re: [RFC] New ausearch output option & audit viewing in Spacewalk Date: Mon, 8 Jun 2009 13:17:00 -0400 Message-ID: <4A2D478C.3000400@gtri.gatech.edu> References: <4A2D406D.1080105@gtri.gatech.edu> <4A2D467B.7000201@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4A2D467B.7000201@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: John Dennis Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On 06/08/2009 01:12 PM, John Dennis wrote: > Joshua Roys wrote: >> Hello all. >> >> As part of developing an audit viewing "plugin"[1] to Spacewalk[2], I >> wrote a small program to use libauparse to output (easily) >> machine-parsable audit logs. I think this functionality would be nice >> to have in ausearch, and as such, wrote a patch for it. >> >> As well as reviewing this patch, I would like your feedback concerning >> the Spacewalk audit plugin. Any questions or constructive criticism is >> welcome. > > Would you please post an example of the output and/or the parsing rules. > > Thanks > Basically the following: type=USER_ACCT serial=222 seconds=1244481001 milli=141 user pid=24777 uid=root auid=unset ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 op=PAM:accounting acct=root exe=/usr/sbin/crond hostname=? addr=? terminal=cron res=success ---- type=CRED_ACQ serial=223 seconds=1244481001 milli=141 user pid=24777 uid=root auid=unset ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 op=PAM:setcred acct=root exe=/usr/sbin/crond hostname=? addr=? terminal=cron res=success ---- type=LOGIN serial=224 seconds=1244481001 milli=141 login pid=24777 uid=root old auid=unset new auid=root old ses=4294967295 new ses=34 ---- Simply key=value with all nodes separated by "----\n". I should note that the patch has not been exhaustively tested, it's more of a RFC and also a request for those more knowledgeable of the audit logs to improve upon it. Thanks, Joshua Roys