From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Cerri Subject: Re: [PATCH] auvirt: a new tool for reporting events related to virtual machines Date: Fri, 13 Jan 2012 15:25:05 -0200 Message-ID: <4F1068F1.9060402@linux.vnet.ibm.com> References: <1323964611-30053-1-git-send-email-mhcerri@linux.vnet.ibm.com> <4F05D389.8090808@linux.vnet.ibm.com> <4F0B1D30.7070900@linux.vnet.ibm.com> <201201111648.46860.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx13.extmail.prod.ext.phx2.redhat.com [10.5.110.18]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id q0DHPDsA026794 for ; Fri, 13 Jan 2012 12:25:13 -0500 Received: from e24smtp02.br.ibm.com (e24smtp02.br.ibm.com [32.104.18.86]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q0DHPBNU010447 for ; Fri, 13 Jan 2012 12:25:11 -0500 Received: from /spool/local by e24smtp02.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 13 Jan 2012 15:25:10 -0200 In-Reply-To: <201201111648.46860.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com, gcwilson@us.ibm.com, bryntcor@us.ibm.com List-Id: linux-audit@redhat.com Hi, These are some output examples of auvirt. What do you think? I just added a "--full" option because libvirt can generate several resource events and this can make the output confusing. Regards, Marcelo ------ $ ./auvirt start guest-name-1 root Tue Jan 10 11:05 stop guest-name-1 root Tue Jan 10 11:39 start guest-name-2 root Wed Jan 11 15:23 start guest-name-2 root Wed Jan 11 16:28 start guest-name-1 root Wed Jan 12 19:47 $ ./auvirt --show-uuid start guest-name-1 fb4149f5-9ff6-4095-f6d3-a1d03936fdfa root Tue Jan 10 11:05 stop guest-name-1 fb4149f5-9ff6-4095-f6d3-a1d03936fdfa root Tue Jan 10 11:39 start guest-name-2 f937029b-93ca-4e13-b40b-663f46323503 root Wed Jan 11 15:23 start guest-name-2 f937029b-93ca-4e13-b40b-663f46323503 root Wed Jan 11 16:28 start guest-name-1 fb4149f5-9ff6-4095-f6d3-a1d03936fdfa root Wed Jan 12 19:47 $ ./auvirt --summary # keep the same behaviour $ ./auvirt --uuid fb4149f5-9ff6-4095-f6d3-a1d03936fdfa start guest-name-1 root Tue Jan 10 11:05 stop guest-name-1 root Tue Jan 10 11:39 start guest-name-1 root Wed Jan 12 19:47 $ ./auvirt --vm-name guest-name-2 start guest-name-2 root Wed Jan 11 15:23 start guest-name-2 root Wed Jan 11 16:28 $ ./auvirt --full --uuid f937029b-93ca-4e13-b40b-663f46323503 res guest-name-2 root Wed Jan 11 15:23 disk "?" "/images/guest-2.img" res guest-name-2 root Wed Jan 11 15:23 vcpu "0" "4" res guest-name-2 root Wed Jan 11 15:23 net "?" "52:54:00:DB:AE:B4" res guest-name-2 root Wed Jan 11 15:23 mem "?" "1048576" start guest-name-2 root Wed Jan 11 15:23 avc guest-name-2 root Wed Jan 11 19:49 read "/images/guest-2.img" denied res guest-name-2 root Wed Jan 11 15:23 mem "1048576" "2097152" stop guest-name-2 root Wed Jan 11 16:28 $ ./auvirt --full # same as above but showing events related to all guests On 01/11/2012 07:48 PM, Steve Grubb wrote: > On Monday, January 09, 2012 12:00:32 PM Marcelo Cerri wrote: >> Just another question. >> >> Currently, auvirt has two different modes defined by the options >> "--summary" and "--raw". In your last email, you suggested that summary >> would be laid out like the aulast program. > > Yeah, I was thinking of something like a timeline so that you can what happened > to resources and in what order. It just so happens aulast is also a time line of > system boots and logins. When it comes to a virt guest, I would want to see it > boot, things assigned, things removed, anything funny happening to it, and then > it shutting down. I also think the host being booted/shutdown might ought to be > in there, too. > > >> Do you think that would be a good idea to have a option to output all the >> matched records, as in "--raw", but using a layout similar to aulast too? > > I think you want both a concise report and the ability to pull the just records > that made up the report. Aulast does this by having a proof mode that instead of > giving you the records, it tells you how to pull them with ausearch. > > -Steve > > >> On 01/05/2012 02:44 PM, Marcelo Cerri wrote: >>> Hi Steve, >>> >>> Thanks for you feedback. >>> >>> I'm already updating the source code based on your comments and >>> looking for another events that may be correlated to a VM. >>> >>> But I'm not sure what means "anomaly events". Would it be malformed >>> records (without some fields, for example) or a specific record type >>> generated by the kernel or some other userspace application? >>> >>> Regards, >>> Marcelo >>> >>> On 12/20/2011 04:18 PM, Steve Grubb wrote: >>>> On Thursday, December 15, 2011 10:56:51 AM Marcelo Cerri wrote: >>>>> This patch adds a new tool to extract information related to virtual >>>>> machines from the audit log files. It can output a summary with >>>>> information about the number of events found with details by type of >>>>> record and operation. The tool can also output the filtered records as >>>>> found in the audit log. >>>>> >>>>> Using the --avc option auvirt tries to correlate AVC records to the >>>>> guests >>>>> based on its security context. It's also possible to select records >>>>> related >>>>> to just one guest using the UUID or the guest name. >>>> >>>> I'm wondering about this tool. It runs fine. But I thought you were >>>> wanting to do >>>> some more sophisticated analysis of events. For example this is the >>>> current >>>> output: >>>> >>>> $ ./auvirt --file ../../../virt-audit.log >>>> Total records: 6 >>>> Virt records: 6 >>>> Resource records: 4 >>>> Machine ID records: 1 >>>> AVC records: 0 >>>> >>>> Operations: >>>> Start: 1 >>>> Stop: 0 >>>> >>>> Considered time: >>>> Start: Tue Dec 20 09:33:01 2011 >>>> End: Tue Dec 20 09:33:01 2011 >>>> >>>> This is not much different than what can be reported by >>>> ausearch/report with the >>>> new uuid and vm search fields. Also, testing with the uuid number >>>> doesn't seem to >>>> get any hits. But using the vm name does. >>>> >>>> I plan to add a very basic virt report to aureport soon. I was >>>> wondering if the >>>> above is all anyone really wanted to see? I would think that perhaps >>>> you want >>>> some info about start/stop assignment of resources, changes in >>>> resources, and >>>> perhaps MAC or anomaly events related to a vm. But laid out like the >>>> aulast >>>> program. >>>> >>>> boot vm-name time (total runtime) >>>> resource what-kind old-value new-value time (total time assigned) >>>> avc access-type obj results time >>>> shutdown vm-name time >>>> >>>> and there might be other audit events associated with a vm. >>>> >>>> -Steve >