Config_change events

Config_change events

[MAUPERTUIS, PHILIPPE]

[-- Attachment #1.1: Type: text/plain, Size: 1660 bytes --]

Hi,
When I issue a service auditd restart, I get the following events :
[root@xxxxxxxx ~]# ausearch -k 10.5.5-modification-audit -ts recent --format raw
node=xxxxxxxx type=CONFIG_CHANGE msg=audit(1577725960.912:8745):  auid=4294967295 ses=4294967295 op=remove_rule key="10.5.5-modification-audit" list=4 res=1AUID="unset"
node=xxxxxxxx type=CONFIG_CHANGE msg=audit(1577725960.947:8777):  auid=4294967295 ses=4294967295 op=add_rule key="10.5.5-modification-audit" list=4 res=1AUID="unset"

How can I link this event to the daemon_start daemon_end events ?
How can I trace the CONFIG_CHANGE events to a user action ?
Are the Daemon_start and daemon_end events specifically linked to auditd ?

Thanks for the clarification

Philippe

equensWorldline is a registered trade mark and trading name owned by the Worldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely for the addressee. If you receive this e-mail in error, you are not authorized to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. EquensWorldline and the Worldline Group therefore can accept no liability for any errors or their content. Although equensWorldline and the Worldline Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with equensWorldline and the Worldline Group by email

[-- Attachment #1.2: Type: text/html, Size: 7068 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Config_change events

[Steve Grubb]

On Monday, December 30, 2019 12:21:15 PM EST MAUPERTUIS, PHILIPPE wrote:
> When I issue a service auditd restart, I get the following events :
> [root@xxxxxxxx ~]# ausearch -k 10.5.5-modification-audit -ts recent
> --format raw node=xxxxxxxx type=CONFIG_CHANGE
> msg=audit(1577725960.912:8745):  auid=4294967295 ses=4294967295
> op=remove_rule key="10.5.5-modification-audit" list=4 res=1AUID="unset"
> node=xxxxxxxx type=CONFIG_CHANGE msg=audit(1577725960.947:8777): 
> auid=4294967295 ses=4294967295 op=add_rule key="10.5.5-modification-audit"
> list=4 res=1AUID="unset"
> 
> How can I link this event to the daemon_start daemon_end events ?

The best way is by a time window. Did it occur within a second of the audit 
daemon starting or stopping?

> How can I trace the CONFIG_CHANGE events to a user action ?

You would have to place a watch on auditctl. In this particular case, auid 
and session are -1, which means a daemon did it.

> Are the Daemon_start and daemon_end events specifically linked to auditd ?

Yes.

-Steve