Announcing audit-viewer

Hello,
audit-viewer is now available in Fedora 9. It is a GUI for viewing audit logs and running simple reports on them, intended as an ueasy to use alternative to ausearch and aureport. To see what audit-viewer can do, please read
https://fedorahosted.org/audit-viewer/wiki/AuditViewerTour .

The program is still under development, more features (graphs in particular) and more polish is planned. I'll be grateful for any feedback (what works well, what doesn't work, what is difficult to do or unintuitive).

To install audit-viewer on Fedora, run (yum install audit-viewer). Then you'll find it in the System/Administration menu as "Audit Logs".

To build audit-viewer on other distributions, you'll need the source code available at https://fedorahosted.org/audit-viewer/ . audit-viewer depends on python-gtkextra, and the last release of python-gtkextra doesn't build on recent systems. You may find the patch at
http://cvs.fedora.redhat.com/viewcvs/devel/python-gtkextra/ useful.
Mirek

So far so good.
One very trivial suggestion is to have a horizontal scroll bar on the bottom, so that when the "other fields" is off the page I can still see the entire event.

Thx,
LCB.

LC (Lenny) Bruzenak
[email protected]

Mirek,

First thing I want to say is that this is a really good first release tool! There are a lot of things I like and so far not a lot I don't. I have a couple of questions though:

1: The filters all seem to work fine, and I like the ability to store the filter config. One thing I believe would be helpful, though, it to have a way of temporarily filtering from the main screen without having to add a specific filter, save it and then later remove it. Like a "filter on": button added near the "Edit". It would need a corresponding "clear" to reset. I recall my own use of the handy Evolution mail search tool.

2: I'd also like to be able to launch results in a new window. The reason for this is I see how helpful it would be to see, as an example, a side-by-side audit comparison between hosts. What I'd do is filter on a particular hostname & open that in a new window. Then I'd filter on a different hostname and open those results in a new window. Then I could easily compare what 2 different machines audit results look like. This would be in a situation where I am seeing some audit anomaly or some key in the audit data on one host but not another.

I'd consider these to be non-critical enhancements because I can do everything I say above in (1) by making more filter configs and loading those. I can also do the request in (2) by launching multiple audit-viewers and then manipulating as desired.

But so far in my testing these are the things I see which would be helpful and I thought you would appreciate some feedback. Again, kudos on a nice initial release!

LCB.

LC (Lenny) Bruzenak
[email protected]

Hello,
LC Bruzenak píše v Čt 22. 05. 2008 v 17:27 -0500:

I'm afraid the field width cannot be tuned automatically; the performance hit is too large. You can resize the "Other fields" column manually (using the small field separator at the very right of the column headers), and the scroll bar will appear if the field is wide enough.

If you want to see the details of a specific event, double-click it to see the "event details" dialog[1]. For often-used fields, you can add them as columns to a saved view.

Thanks a lot for testing audit-viewer,
Mirek

[1] Buttons for moving to the previous/next event will be added to the dialog to make this way of viewing the records more comfortable.

I went to try this and now have another problem - audit-viewer is crashing on startup. Last week I updated to some new python modules.

Now when I try to run audit-viewer I get:

[root@hugo audit]# audit-viewer
Traceback (most recent call last):
File "/usr/share/audit-viewer/main.py", line 73, in <module>

    w.run(cl, args)
  File "/usr/share/audit-viewer/main_window.py", line 115, in run
    self.__refresh_all_tabs()

File "/usr/share/audit-viewer/main_window.py", line 328, in
__refresh_all_tabs
tab.refresh()
File "/usr/share/audit-viewer/list_tab.py", line 121, in refresh
True)
File "/usr/share/audit-viewer/main_window.py", line 209, in
read_events
keep_raw_records)
File "/usr/share/audit-viewer/event_source.py", line 135, in
read_events
e = events[(ts.serial, ts.sec, ts.milli)]
AttributeError: 'NoneType' object has no attribute 'serial'

Here is the complete list of python rpms(please let me know what else I can provide):

[root@hugo audit]# rpm -qa | grep python | sort
at-spi-python-1.22.1-1.fc9.x86_64
audit-libs-python-1.7.4-1.fc9.x86_64
cracklib-python-2.8.12-2.x86_64
dbus-python-0.82.4-2.fc9.x86_64
gamin-python-0.1.9-5.fc9.x86_64
gnome-python2-2.22.0-2.fc9.x86_64
gnome-python2-applet-2.22.0-2.fc9.x86_64
gnome-python2-bonobo-2.22.0-2.fc9.x86_64
gnome-python2-canvas-2.22.0-2.fc9.x86_64
gnome-python2-desktop-2.22.0-2.fc9.x86_64
gnome-python2-extras-2.19.1-15.fc9.x86_64
gnome-python2-gconf-2.22.0-2.fc9.x86_64
gnome-python2-gnomeprint-2.22.0-2.fc9.x86_64
gnome-python2-gnomevfs-2.22.0-2.fc9.x86_64
gnome-python2-gtkhtml2-2.19.1-15.fc9.x86_64
gnome-python2-libegg-2.19.1-15.fc9.x86_64
gstreamer-python-0.10.11-2.fc9.x86_64
libbdevid-python-6.0.52-2.fc9.x86_64
libselinux-python-2.0.64-2.fc9.x86_64
libuser-python-0.56.9-1.x86_64
libxml2-python-2.6.32-2.fc9.x86_64
newt-python-0.52.9-1.fc9.x86_64
notify-python-0.1.1-3.fc9.x86_64
python-2.5.1-25.fc9.x86_64
python-crypto-2.0.1-12.1.x86_64
python-devel-2.5.1-25.fc9.i386
python-genshi-0.4.4-2.fc8.noarch
python-gtkextra-1.1.0-3.fc9.x86_64
python-iniparse-0.2.3-3.fc9.noarch
python-libs-2.5.1-25.fc9.i386
python-libs-2.5.1-25.fc9.x86_64
python-numeric-24.2-11.fc9.x86_64
python-paste-1.6-1.fc9.noarch
python-pyblock-0.31-2.x86_64
python-setuptools-0.6c7-2.fc8.noarch
python-sexy-0.1.9-5.fc9.x86_64
python-urlgrabber-3.0.0-8.fc9.noarch
rpm-python-4.4.2.3-2.fc9.x86_64

[root@hugo audit]# rpm -qa | grep audit-viewer
audit-viewer-0.2-2.fc9.x86_64

LCB.

LC (Lenny) Bruzenak
[email protected]