<html dir="ltr"><head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style id="owaTempEditStyle"></style><style title="owaParaStyle"></style> </head> <body ocsi="x"> <div style="FONT-FAMILY: Tahoma; DIRECTION: ltr; COLOR: #000000; FONT-SIZE: 13px"> <div></div> <div dir="ltr"><font color="#000000" size="2" face="Tahoma">I've run into an issue where I have a network of 55 RHEL<a></a><a></a> 5 boxes that each run monitoring software such as nagios<a></a><a></a> and ganglia and are generating roughly 1.2G<a></a><a></a> of audit logs per day. Much of these entries are from the monitoring functionality. I've had to disable audisp<a></a><a></a>, centralized auditing, due to hard drive and networking limitations<a></a>. </font></div> <div dir="ltr"><font color="#000000" size="2" face="Tahoma"></font> </div> <div dir="ltr"><font color="#000000" size="2" face="Tahoma">We're finding that 95% of the audit events fall into three unique events, each repeating causing a tail -f of the audit log to resemble the matrix. I've been Googling<a></a><a></a> and reading posts off this site in attempt to write some filter policies to prevent these from writing to the log. I can safely filter out 159 since its a minor hit (change time). The others are more critical, such as file opens.</font></div> <div dir="ltr"><font size="2" face="tahoma"></font> </div> <div dir="ltr"><font size="2" face="tahoma">I started with a generic filter for all syscall<a></a><a></a> events, this cut it down adequately<a></a>, but we no longer captured the items we wanted to.</font></div> <div dir="ltr"><font size="2" face="tahoma"></font> </div> <div dir="ltr"><font size="2" face="tahoma">Here's some example logs for the two events we are trying to trim down:</font></div> <div dir="ltr"> </div> <div dir="ltr">################<br> ################<br> Netstat sample<br> ################<br> ################<br> type=SYSCALL msg=audit(1307462086.972:1619017): arch=c000003e syscall=2 success=no exit=-2 a0=6d9c790 a1=0 a2=0 a3=3074f234f3 items=2 ppid=4945 pid=32700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=kernel key=(null)<br> type=CWD msg=audit(1307462086.972:1619017): cwd="/"<br> type=PATH msg=audit(1307462086.972:1619017): item=0 name="/usr/share/locale/en.utf8/LC_MESSAGES/net-tools.mo"<br> type=PATH msg=audit(1307462086.972:1619017): item=1 name="/usr/share/locale/en.utf8/LC_MESSAGES/net-tools.mo"</div> <div dir="ltr"><br> ################<br> ################<br> Ganglia Sample<br> ################<br> ################</div> <div dir="ltr">type=SYSCALL msg=audit(1307462163.369:1620406): arch=c000003e syscall=2 per=400000 success=no exit=-2 a0=2aaab81124b8 a1=0 a2=1b6 a3=0 items=2 ppid=678 pid=681 auid=1002 uid=1002 gid=100 euid=1002 suid=1002 fsuid=1002 egid=100 sgid=100 fsgid=100 tty=(none) ses=641 comm="java" exe="/usr/java/jdk1.6.0_24/bin/java" subj=kernel key=(null)<br> type=CWD msg=audit(1307462163.369:1620406): cwd="/home/ganglia"<br> type=PATH msg=audit(1307462163.369:1620406): item=0 name="/proc/net/if_inet6"<br> type=PATH msg=audit(1307462163.369:1620406): item=1 name="/proc/net/if_inet6"</div> <div dir="ltr">type=SYSCALL msg=audit(1307462163.365:1620404): arch=c000003e syscall=2 success=no exit=-20 a0=7fff922a6610 a1=10800 a2=7fff922a68f0 a3=22 items=2 ppid=703 pid=704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=kernel key=(null)<br> type=CWD msg=audit(1307462163.365:1620404): cwd="/"<br> type=PATH msg=audit(1307462163.365:1620404): item=0 name="/etc/modprobe.d/blacklist-firewire" inode=1049506 dev=08:07 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unlabeled<br> type=PATH msg=audit(1307462163.365:1620404): item=1 name="/etc/modprobe.d/blacklist-firewire"</div> <div dir="ltr">type=SYSCALL msg=audit(1307462402.517:1626432): arch=c000003e syscall=2 per=400000 success=no exit=-2 a0=7fff089b2f60 a1=0 a2=2b20f5d60000 a3=62696c2f2e2e2f6e items=2 ppid=2805 pid=2807 auid=1002 uid=1002 gid=100 euid=1002 suid=1002 fsuid=1002 egid=100 sgid=100 fsgid=100 tty=(none) ses=644 comm="java" exe="/usr/java/jdk1.6.0_24/bin/java" subj=kernel key=(null)<br> type=CWD msg=audit(1307462402.517:1626432): cwd="/home/ganglia"<br> type=PATH msg=audit(1307462402.517:1626432): item=0 name="/usr/java/jdk1.6.0_24/bin/../lib/amd64/jli/x86_64/libpthread.so.0"<br> type=PATH msg=audit(1307462402.517:1626432): item=1 name="/usr/java/jdk1.6.0_24/bin/../lib/amd64/jli/x86_64/libpthread.so.0"</div> <div dir="ltr">type=SYSCALL msg=audit(1307462402.517:1626433): arch=c000003e syscall=2 per=400000 success=no exit=-2 a0=7fff089b2f60 a1=0 a2=2b20f5d60000 a3=62696c2f2e2e2f6e items=2 ppid=2805 pid=2807 auid=1002 uid=1002 gid=100 euid=1002 suid=1002 fsuid=1002 egid=100 sgid=100 fsgid=100 tty=(none) ses=644 comm="java" exe="/usr/java/jdk1.6.0_24/bin/java" subj=kernel key=(null)<br> type=CWD msg=audit(1307462402.517:1626433): cwd="/home/ganglia"<br> type=PATH msg=audit(1307462402.517:1626433): item=0 name="/usr/java/jdk1.6.0_24/bin/../lib/amd64/jli/libpthread.so.0"<br> type=PATH msg=audit(1307462402.517:1626433): item=1 name="/usr/java/jdk1.6.0_24/bin/../lib/amd64/jli/libpthread.so.0"</div> <div dir="ltr">type=SYSCALL msg=audit(1307462402.517:1626434): arch=c000003e syscall=2 per=400000 success=no exit=-2 a0=7fff089b2f60 a1=0 a2=2b20f5d60000 a3=65726a2f2e2e2f6e items=2 ppid=2805 pid=2807 auid=1002 uid=1002 gid=100 euid=1002 suid=1002 fsuid=1002 egid=100 sgid=100 fsgid=100 tty=(none) ses=644 comm="java" exe="/usr/java/jdk1.6.0_24/bin/java" subj=kernel key=(null)<br> type=CWD msg=audit(1307462402.517:1626434): cwd="/home/ganglia"<br> type=PATH msg=audit(1307462402.517:1626434): item=0 name="/usr/java/jdk1.6.0_24/bin/../jre/lib/amd64/jli/tls/x86_64/libpthread.so.0"<br> type=PATH msg=audit(1307462402.517:1626434): item=1 name="/usr/java/jdk1.6.0_24/bin/../jre/lib/amd64/jli/tls/x86_64/libpthread.so.0"</div> <div dir="ltr"> </div> <div dir="ltr"><font size="2" face="tahoma">Exemption rules:<br> # a0=0x413586 appears to prevent proc tcp6 messages in the netstat sections<br> -a exit,never -F a0=0x413586 -F success=0<br> -a exit,never -F exit=-6 -F success=0<br> -a exit,never -F exit=-13 -F success=0<br> -a entry,never -S 159<br> # UID 1002 = ganglia user. These do not work as intended.<br> -a user,never -F auid=1002<br> -a user,never -F uid=1002</font></div> <div dir="ltr"><font size="2" face="tahoma"></font> </div> <div dir="ltr">Any ideas on how I can target these audit logs for filtering?</div> <div dir="ltr"><font size="2" face="tahoma"></font> </div> <div dir="ltr">Thanks!</div> <div class="BodyFragment"><font size="2"> <div class="PlainText">Nicholas Stires<a></a><a></a><br> Principal Systems Engineer<br> Bingham Technical Solutions LLC</div> </font></div> </div> </body> </html>