Re: [PATCH] auvirt: a new tool for reporting events related to virtual machines

[Marcelo Cerri <mhcerri@linux.vnet.ibm.com>]

I submitted a patch to libvirt to add the qemu pid (vm-pid) to the 
VIRT_CONTROL audit record.

I'm using this field to correlate anomaly events to guest in auvirt and 
as a fallback it tries to use the SELinux context for that.

Regards,
Marcelo

On 01/25/2012 10:56 AM, Marcelo Cerri wrote:
> I agree that pid and time is a better way for correlation but I was 
> coding a solution based on that when I figured out a problem. There's 
> no qemu pid in the audit logs. Libvirt (at least the libvirt shipped 
> with RHEL 6.2) always logs its own pid to the audit log.
>
> I'll try to discover if there is another way to correlate them or if 
> newer versions of libvirt log the qemu pid to the audit log.
>
> Regards,
> Marcelo
>
> On 01/24/2012 06:27 PM, Steve Grubb wrote:
>> On Tuesday, January 24, 2012 01:08:56 PM Marcelo Cerri wrote:
>>> I took a look at some anomaly events and I'm thinking to correlate them
>>> to guests based on the SELinux context or maybe based on the pid field.
>>>
>>> Do you think there is another ways to correlate them?
>> I was thinking to correlate them based on the time and pid. If its 
>> within the
>> time range between startup/shutdown and its the same pid, then you 
>> have the
>> event correlated. If its outside the time range or a different pid, 
>> then you do
>> not have correlation. I would not look at selinux label because not all
>> systems/distros have it enabled or compiled in. So, pid and time are 
>> the most
>> universal identifiers for correlation.
>>
>> -Steve
>>
>
> -- 
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>