audisp-prelude event not propagated?
I have 2 machines: one collector and one sender.
I added a watched file key with the ids keyword on the sender machine.
Other IDS events (login, AVCs, etc.) propagate from the sender to the collector, so I am sure they are registered correctly (prelude-manager->prelude-manager). Watched file IDS events do not get to the collector.
I have the same rule on the collector machine and verified it generated the prelude "Watched File" event when I touched a file watched with the key:
[root@audit ~]# auditctl -l | grep idsLIST_RULES: exit,always watch=/boot/test perm=wa key=ids-file-hi
Is this a prelude issue or an audit issue?
Thx,
LCB.
audit-1.7.13-1.fc10
prelude-manager-0.9.14.2-2.fc10.x86_64
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 14 lines · LC Bruzenak
I have 2 machines: one collector and one sender.
I added a watched file key with the ids keyword on the sender machine.Other IDS events (login, AVCs, etc.) propagate from the sender to the collector, so I am sure they are registered correctly (prelude-manager->prelude-manager). Watched file IDS events do not get to the collector.
I have the same rule on the collector machine and verified it generated the prelude "Watched File" event when I touched a file watched with the key:
[root@audit ~]# auditctl -l | grep idsLIST_RULES: exit,always watch=/boot/test perm=wa key=ids-file-hi
Quoted 8 lines
Is this a prelude issue or an audit issue?
Thx,
LCB.audit-1.7.13-1.fc10
prelude-manager-0.9.14.2-2.fc10.x86_64
The detail in the IDS event generated locally on the collector isn't complete. Under "Target" there is a "Target file current" block. The "Name" value shows up as: "/" but the "Path" value is "/boot/".
The corresponding audit event is below.
node=audit type=PATH msg=audit(09/16/2009 20:26:54.945:271) : item=1 name=/boot/test inode=16 dev=08:01 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:boot_t:s0
node=audit type=PATH msg=audit(09/16/2009 20:26:54.945:271) : item=0 name=/boot/ inode=2 dev=08:01 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:boot_t:s0
node=audit type=CWD msg=audit(09/16/2009 20:26:54.945:271) : cwd=/root node=audit type=SYSCALL msg=audit(09/16/2009 20:26:54.945:271) :
arch=x86_64 syscall=open success=yes exit=3 a0=7fffbe53d9c3 a1=941 a2=1b6 a3=386016d12c items=2 ppid=2275 pid=2448 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=touch exe=/bin/touch subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=ids-file-hi
Maybe the 2 "PATH" components confused the plugin code?
LCB.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 15 lines · LC Bruzenak
Quoted 14 lines · LC Bruzenak
I have 2 machines: one collector and one sender.
I added a watched file key with the ids keyword on the sender machine.Other IDS events (login, AVCs, etc.) propagate from the sender to the collector, so I am sure they are registered correctly (prelude-manager->prelude-manager). Watched file IDS events do not get to the collector.
I have the same rule on the collector machine and verified it generated the prelude "Watched File" event when I touched a file watched with the key:
[root@audit ~]# auditctl -l | grep idsLIST_RULES: exit,always watch=/boot/test perm=wa key=ids-file-hi
Quoted 8 lines
Quoted 8 lines
Is this a prelude issue or an audit issue?
Thx,
LCB.audit-1.7.13-1.fc10
prelude-manager-0.9.14.2-2.fc10.x86_64
...and both machines have identical /etc/audisp/audisp-prelude.conf files.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 21 lines · LC Bruzenak
Quoted 20 lines · LC Bruzenak
Quoted 19 lines · LC Bruzenak
I have 2 machines: one collector and one sender.
I added a watched file key with the ids keyword on the sender machine.Other IDS events (login, AVCs, etc.) propagate from the sender to the collector, so I am sure they are registered correctly (prelude-manager->prelude-manager). Watched file IDS events do not get to the collector.
I have the same rule on the collector machine and verified it generated the prelude "Watched File" event when I touched a file watched with the key:
[root@audit ~]# auditctl -l | grep idsLIST_RULES: exit,always watch=/boot/test perm=wa key=ids-file-hiIs this a prelude issue or an audit issue?
Thx,
LCB.
Quoted 7 lines
Quoted 3 lines
Quoted 3 lines
audit-1.7.13-1.fc10
prelude-manager-0.9.14.2-2.fc10.x86_64...and both machines have identical
/etc/audisp/audisp-prelude.conffiles.
Must be a prelude issue since I see the event being generated when I run prelude-manager in debug mode. I'll stop sending info on this one now but if anyone else has the same issue later contact me and I'll share the eventual fix.
LCB.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]