From mboxrd@z Thu Jan 1 00:00:00 1970 From: Burn Alting Subject: Re: Send a message to audit.log Date: Sat, 02 Feb 2019 14:37:27 +1100 Message-ID: References: Reply-To: burn@swtf.dyndns.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7999976896297329479==" Return-path: Received: from mx1.redhat.com (ext-mx01.extmail.prod.ext.phx2.redhat.com [10.5.110.25]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 4ED49608DD for ; Sat, 2 Feb 2019 03:45:20 +0000 (UTC) Received: from mail.swtf.dyndns.org (124-171-156-127.dyn.iinet.net.au [124.171.156.127]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4130181F12 for ; Sat, 2 Feb 2019 03:45:18 +0000 (UTC) Received: from mail.swtf.dyndns.org (localhost [127.0.0.1]) by mail.swtf.dyndns.org (Postfix) with ESMTP id EAD60203002F for ; Sat, 2 Feb 2019 14:37:32 +1100 (AEDT) Received: from mail.swtf.dyndns.org ([127.0.0.1]) by mail.swtf.dyndns.org (mail.swtf.dyndns.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id EVyCQa3NJt8w for ; Sat, 2 Feb 2019 14:37:29 +1100 (AEDT) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Wajih Ul Hassan , linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============7999976896297329479== Content-Type: multipart/alternative; boundary="=-T4D49EXofWeyRtW7guhd" --=-T4D49EXofWeyRtW7guhd Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Wajih, Try man audit_log_user_messageand note the need for CAP_AUDIT_WRITE ability (see auditctl(8)) That said. Is there a reason you want a message going into the system kernel logging mechanism? The only reason why I ask is, if your audit rules posture is aggressive (many rules that fire) then you could will slow down your application as it waits to insert a message into the NETLINK_SOCKET is uses. On *nix, syslog is the normal destination for application event logs. By separating your application logs from operating system logs, you can more efficiently post process them. RegardsOn Fri, 2019-02-01 at 17:03 -0600, Wajih Ul Hassan wrote: > Hi, > Hi, I have a C application which needs to send a message to audit.log from > userspace. I have been using `auditctl -m` format to send a message to audit.log > using `system` command but it seems to degrade performance a lot of my > application. > My question is there any API to send a message programmatically from my > application which is more efficient and robust. > Thanks, > Wajih > > --Linux-audit mailing listLinux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit --=-T4D49EXofWeyRtW7guhd Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Wajih,

Try

man audit_log= _user_message

and note the need for CAP_AUDIT_WRITE ability (see = auditctl(8))

That said. Is there a reason you want= a message going into the system kernel logging mechanism? The only reason = why I ask is, if your audit rules posture is aggressive (many rules that fi= re) then you could will slow down your application as it waits to insert a = message into the NETLINK_SOCKET is uses.

On *nix, = syslog is the normal destination for application event logs. By separating = your application logs from operating system logs, you can more efficiently = post process them.

Regards

On Fri, 2019-= 02-01 at 17:03 -0600, Wajih Ul Hassan wrote:

Hi,
Hi, I have a C application which needs to send a message to= audit.log from userspace. I have been using `auditctl -m` format to send a= message to audit.log using `system` command but it seems to degrade p= erformance a lot of my application.
My question is there any API to send a m= essage programmatically from my application which is more efficient and rob= ust.
Thanks,
Wajih
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailma=
n/listinfo/linux-audit

--=-T4D49EXofWeyRtW7guhd-- --===============7999976896297329479== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7999976896297329479==--