From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Config_change events Date: Sat, 04 Jan 2020 16:07:02 -0500 Message-ID: <6165760.8hHFWGXKb8@x2> References: <5F4EE10832231F4F921A255C1D954298251E24@DEERLM99EX7MSX.ww931.my-it-solutions.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <5F4EE10832231F4F921A255C1D954298251E24@DEERLM99EX7MSX.ww931.my-it-solutions.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: "MAUPERTUIS, PHILIPPE" List-Id: linux-audit@redhat.com On Monday, December 30, 2019 12:21:15 PM EST MAUPERTUIS, PHILIPPE wrote: > When I issue a service auditd restart, I get the following events : > [root@xxxxxxxx ~]# ausearch -k 10.5.5-modification-audit -ts recent > --format raw node=xxxxxxxx type=CONFIG_CHANGE > msg=audit(1577725960.912:8745): auid=4294967295 ses=4294967295 > op=remove_rule key="10.5.5-modification-audit" list=4 res=1AUID="unset" > node=xxxxxxxx type=CONFIG_CHANGE msg=audit(1577725960.947:8777): > auid=4294967295 ses=4294967295 op=add_rule key="10.5.5-modification-audit" > list=4 res=1AUID="unset" > > How can I link this event to the daemon_start daemon_end events ? The best way is by a time window. Did it occur within a second of the audit daemon starting or stopping? > How can I trace the CONFIG_CHANGE events to a user action ? You would have to place a watch on auditctl. In this particular case, auid and session are -1, which means a daemon did it. > Are the Daemon_start and daemon_end events specifically linked to auditd ? Yes. -Steve