From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Cerri Subject: Re: [PATCH] auvirt: a new tool for reporting events related to virtual machines Date: Mon, 09 Jan 2012 15:00:32 -0200 Message-ID: <4F0B1D30.7070900@linux.vnet.ibm.com> References: <1323964611-30053-1-git-send-email-mhcerri@linux.vnet.ibm.com> <201112201318.16636.sgrubb@redhat.com> <4F05D389.8090808@linux.vnet.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q09H0fkC006354 for ; Mon, 9 Jan 2012 12:00:41 -0500 Received: from e24smtp05.br.ibm.com (e24smtp05.br.ibm.com [32.104.18.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q09H0eQL011399 for ; Mon, 9 Jan 2012 12:00:40 -0500 Received: from /spool/local by e24smtp05.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 9 Jan 2012 15:00:36 -0200 In-Reply-To: <4F05D389.8090808@linux.vnet.ibm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com, gcwilson@us.ibm.com, bryntcor@us.ibm.com List-Id: linux-audit@redhat.com Just another question. Currently, auvirt has two different modes defined by the options "--summary" and "--raw". In your last email, you suggested that summary would be laid out like the aulast program. Do you think that would be a good idea to have a option to output all the matched records, as in "--raw", but using a layout similar to aulast too? Regards, Marcelo On 01/05/2012 02:44 PM, Marcelo Cerri wrote: > Hi Steve, > > Thanks for you feedback. > > I'm already updating the source code based on your comments and > looking for another events that may be correlated to a VM. > > But I'm not sure what means "anomaly events". Would it be malformed > records (without some fields, for example) or a specific record type > generated by the kernel or some other userspace application? > > Regards, > Marcelo > > On 12/20/2011 04:18 PM, Steve Grubb wrote: >> On Thursday, December 15, 2011 10:56:51 AM Marcelo Cerri wrote: >>> This patch adds a new tool to extract information related to virtual >>> machines from the audit log files. It can output a summary with >>> information about the number of events found with details by type of >>> record and operation. The tool can also output the filtered records as >>> found in the audit log. >>> >>> Using the --avc option auvirt tries to correlate AVC records to the >>> guests >>> based on its security context. It's also possible to select records >>> related >>> to just one guest using the UUID or the guest name. >> I'm wondering about this tool. It runs fine. But I thought you were >> wanting to do >> some more sophisticated analysis of events. For example this is the >> current >> output: >> >> $ ./auvirt --file ../../../virt-audit.log >> Total records: 6 >> Virt records: 6 >> Resource records: 4 >> Machine ID records: 1 >> AVC records: 0 >> Operations: >> Start: 1 >> Stop: 0 >> Considered time: >> Start: Tue Dec 20 09:33:01 2011 >> End: Tue Dec 20 09:33:01 2011 >> >> This is not much different than what can be reported by >> ausearch/report with the >> new uuid and vm search fields. Also, testing with the uuid number >> doesn't seem to >> get any hits. But using the vm name does. >> >> I plan to add a very basic virt report to aureport soon. I was >> wondering if the >> above is all anyone really wanted to see? I would think that perhaps >> you want >> some info about start/stop assignment of resources, changes in >> resources, and >> perhaps MAC or anomaly events related to a vm. But laid out like the >> aulast >> program. >> >> boot vm-name time (total runtime) >> resource what-kind old-value new-value time (total time assigned) >> avc access-type obj results time >> shutdown vm-name time >> >> and there might be other audit events associated with a vm. >> >> -Steve >> >