overhead of auditd

overhead of auditd

[杨海]

[-- Attachment #1.1.1: Type: text/plain, Size: 312 bytes --]

Hi,


Turning on all system calls in audit.rules, and transferring a tar file to the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU usage.
Is it expected? 
BTW, after turning write-logs off, and add dispatcher, both "audispd" and "auditd" are consuming high CPU.




Regards
Hai

[-- Attachment #1.1.2: Type: text/html, Size: 506 bytes --]

[-- Attachment #1.2: DAF3F9AF@3D976D26.41FD275D.png --]
[-- Type: application/octet-stream, Size: 22967 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: overhead of auditd

[Steve Grubb]

Hello,

On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
> Turning on all system calls in audit.rules, and transferring a tar file to
> the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU
> usage. Is it expected?

It would not be surprising. Some system calls have more overhead than others. 
So, depending on everything that is running, you can kill your system.

> BTW, after turning write-logs off, and add dispatcher, both "audispd" and
> "auditd" are consuming high CPU.

They have a lot of events to handle.

-Steve



--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: overhead of auditd

[杨海]

[-- Attachment #1.1: Type: text/plain, Size: 1013 bytes --]

Hi Steve,


I ever read the document you wrote about laying IDS on top of auditd. And I suppose inotify could be lightweight for IDS. Any comment?


Best regards
Hai







 
------------------ Original ------------------
From:  "Steve Grubb"<sgrubb@redhat.com>;
Date:  Fri, Jul 12, 2019 08:14 PM
To:  "linux-audit"<linux-audit@redhat.com>; 
Cc:  "杨海"<hai.yang@magic-shield.com>; 
Subject:  Re: overhead of auditd

 

Hello,

On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
> Turning on all system calls in audit.rules, and transferring a tar file to
> the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU
> usage. Is it expected?

It would not be surprising. Some system calls have more overhead than others. 
So, depending on everything that is running, you can kill your system.

> BTW, after turning write-logs off, and add dispatcher, both "audispd" and
> "auditd" are consuming high CPU.

They have a lot of events to handle.

-Steve

[-- Attachment #1.2: Type: text/html, Size: 2026 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: overhead of auditd

[F Rafi]

[-- Attachment #1.1: Type: text/plain, Size: 1521 bytes --]

You can enable the syscalls that you think will be helpful from an IDS
perspective.

There are also other downstream tools like goaudit and OSS kernel modules
like sysdig falco (not related to auditd) which may be able to simplify
things for you.

Farhan

On Mon, Jul 15, 2019 at 6:25 AM 杨海 <hai.yang@magic-shield.com> wrote:

> Hi Steve,
>
> I ever read the document you wrote about laying IDS on top of auditd. And
> I suppose inotify could be lightweight for IDS. Any comment?
>
> Best regards
> Hai
>
>
> ------------------ Original ------------------
> *From: * "Steve Grubb"<sgrubb@redhat.com>;
> *Date: * Fri, Jul 12, 2019 08:14 PM
> *To: * "linux-audit"<linux-audit@redhat.com>;
> *Cc: * "杨海"<hai.yang@magic-shield.com>;
> *Subject: * Re: overhead of auditd
>
> Hello,
>
> On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
> > Turning on all system calls in audit.rules, and transferring a tar file
> to
> > the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU
> > usage. Is it expected?
>
> It would not be surprising. Some system calls have more overhead than
> others.
> So, depending on everything that is running, you can kill your system.
>
> > BTW, after turning write-logs off, and add dispatcher, both "audispd" and
> > "auditd" are consuming high CPU.
>
> They have a lot of events to handle.
>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

[-- Attachment #1.2: Type: text/html, Size: 3219 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: overhead of auditd

[Steve Grubb]

On Monday, July 15, 2019 6:21:11 AM EDT 杨海 wrote:
> I ever read the document you wrote about laying IDS on top of auditd. And I
> suppose inotify could be lightweight for IDS. Any comment?

Yes, audit works fine for IDS work. But one would not audit all syscalls for 
every program. That will kill your system. You have to be selective about 
what you are auditing.

-Steve
 
> ------------------ Original ------------------
> From:  "Steve Grubb"<sgrubb@redhat.com>;
> Date:  Fri, Jul 12, 2019 08:14 PM
> To:  "linux-audit"<linux-audit@redhat.com>; 
> Cc:  "杨海"<hai.yang@magic-shield.com>; 
> Subject:  Re: overhead of auditd
> 
> Hello,
> 
> On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
> 
> > Turning on all system calls in audit.rules, and transferring a tar file
> > to the target system (CentOS 7, 4 cores), I found "auditd" consumes
> > high CPU usage. Is it expected?
> 
> It would not be surprising. Some system calls have more overhead than
> others.  So, depending on everything that is running, you can kill your
> system. 
> 
> > BTW, after turning write-logs off, and add dispatcher, both "audispd"
> > and  "auditd" are consuming high CPU.
> 
> They have a lot of events to handle.




--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit