<div dir="ltr">Steve,<div><br></div><div>This machine is on Marine Corp network and is undergoing DISA RHEL 5 STIG. We have a software package called CAARS which is simply an "After Action Review" suite of software. The CAARS grabs events from the simulation, audio, and a host of other items to enable the soldier to quickly put together an after action review with his troops to review the just completed training scenario.</div> <div><br></div><div>CAARS has a mysql database. Post STIG I received a bug notice from OnTIME which said the /var/log/messages file is filling up fast. After a qiuck review, I noticed the log entry posted in this email chain.</div> <div><br></div><div>How did you "interpret" the log setting to retreive the syscall "<span style="font-family:arial,sans-serif;font-size:13px">sched_setparam"? Anyhow I am not sure why we want this, I have no idea what the sched_setparam actually does. Did you do a lookup on the mysql syscall number?</span></div> <div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Again, I always appreciate your assistance.</span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br> </span></div><div><span style="font-family:arial,sans-serif;font-size:13px">V/R</span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br> </span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Derek</span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><br></div> </div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><p><span style="font-family:"Garamond","serif"">Derek Warner – CISSP-ISSEP</span></p> <p><span style="font-family:"Garamond","serif"">Information System Security Engineer</span></p> <p><span style="font-family:"Garamond","serif"">Riptide Software</span></p> <p><span style="font-family:"Garamond","serif"">w- 321-296-0068 x 136</span></p> <p><span style="font-family:"Garamond","serif"">c- 407-716-9223</span></p> <p><span style="font-family:"Garamond","serif""><a href="mailto:derek.warner@riptidesoftware.com" target="_blank">derek.warner@riptidesoftware.com</a></span></p> <p><span style="font-family:"Garamond","serif""><a href="mailto:derek.a.warner@us.army.mil" target="_blank">derek.a.warner@us.army.mil</a> </span></p></div></div> <br><br><div class="gmail_quote">On Mon, Dec 9, 2013 at 9:32 AM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Friday, December 06, 2013 03:34:27 PM Derek Warner wrote:<br> > ALCON,<br> ><br> > We have a Centos machine running Centos 6 and it uses mysql. When a<br> > standard user operates the system, our /var/log/messages gets filled up<br> > with around 2gb of audit data rather quickly. Here is the audit.<br> ><br> > Dec 6 15:22:12 aaa-bbb audispd: node=aaa-bbb.ccc.ddd.eee type=SYSCALL<br> > msg=audit(1386361331.932:3572423): arch=c000003e syscall=142 success=no<br> > exit=-22 a0=1f46 a1=7f5e6357e290 a2=d3b6f8 a3=1f68 items=0 ppid=2518<br> > pid=8006 auid=4294967295 uid=496 gid=492 euid=496 suid=496 fsuid=496<br> > egid=492 sgid=492 fsgid=492 tty=(none) ses=4294967295 comm="mysqld"<br> > exe="/usr/libexec/mysqld" key=(null)<br> <br> People can more easily help if this were interpreted. It yields this:<br> <br> node=aaa-bbb.ccc.ddd.eee type=SYSCALL msg=audit(12/06/2013<br> 15:22:11.932:3572423) : arch=x86_64 syscall=sched_setparam success=no<br> exit=-22(Invalid argument) a0=0x1f46 a1=0x7f5e6357e290 a2=0xd3b6f8 a3=0x1f68<br> items=0 ppid=2518 pid=8006 auid=unset uid=avahi gid=avahi euid=avahi<br> suid=avahi fsuid=avahi egid=avahi sgid=avahi fsgid=avahi tty=(none) ses=unset<br> comm=mysqld key=(null)<br> <br> <br> > I have tried the following:<br> ><br> > -a exit,never -F path=/usr/libexec/mysqld<br> <br> This only stops events that supply a path as an argument.<br> <br> <br> > When using "-F" I noticed in one RHEL forum someone used -F exe=<br> ><br> > However in CENTOS exe is not a recognized field when using -F<br> <br> True. You can look at the auditctl man page to see what is supported.<br> <br> <br> > We do not wish to audit this data, can someone please help me exclude the<br> > audit?<br> <br> What this is saying is that mysql is calling sched_setparam and getting<br> EINVAL. I have to ask why you would want this? You also don't set a key for<br> the event which makes later analysis more difficult. You could re-write the rule<br> as follows:<br> <br> -a always,exit -F arch=b64 -S sched_setparam -F exit!=-EINVAL<br> <br> <br> But this looks vaguely familiar...<br> <a href="http://magazine.hitb.org/issues/HITB-Ezine-Issue-005.pdf" target="_blank">http://magazine.hitb.org/issues/HITB-Ezine-Issue-005.pdf</a><br> <br> On page 12 I explain what's wrong with mysqld's code.<br> <span class="HOEnZb"><font color="#888888"><br> -Steve<br> </font></span></blockquote></div><br></div>