<html><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:10pt"><div><span>This makes sense to me. I am all for it.</span></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;"><span> +1</span></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;"><br><span></span></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;"><span>R,</span></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family:
verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;"><span>-Joe<br></span></div><div><br></div><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Steve Grubb <sgrubb@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> burn@swtf.dyndns.org <br><b><span style="font-weight: bold;">Cc:</span></b> linux-audit@redhat.com <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, August 18, 2014 5:59 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: ausearch checkpoint capability<br> </font> </div> <div
class="y_msg_container"><br>Hello,<br clear="none"><br clear="none">On Tuesday, August 19, 2014 07:49:50 AM Burn Alting wrote:<br clear="none">> Just to confirm:<br clear="none">> <br clear="none">> the patch would modify the --start command line processing to accept<br clear="none">> a string argument of 'checkpoint-time' AND if a checkpoint file has also<br clear="none">> been provided via the --checkpoint arg AND there is a timestamp within<br clear="none">> the specified file, we use the timestamp stored within the file?<br clear="none"><br clear="none">Yes. I am close to doing a new release of the audit package. I am kind of <br clear="none">aiming towards the end of this week. If its ready by then, I'll include it in <br clear="none">the new release. If not, maybe next release.<br clear="none"><br clear="none">Also, if anyone else has bugs to report, patches to send, etc. now would be a <br clear="none">good time if they needed
it to go out soonish.<br clear="none"><br clear="none">Thanks,<div class="qtdSeparateBR"><br><br></div><div class="yqt5869831246" id="yqtfd40505"><br clear="none">-Steve<br clear="none"><br clear="none"><br clear="none">> On Mon, 2014-08-18 at 14:13 -0400, Steve Grubb wrote:<br clear="none">> > Hello,<br clear="none">> > <br clear="none">> > On Saturday, August 16, 2014 09:25:16 AM Burn Alting wrote:<br clear="none">> > > One of the issues with ausearch's checkpoint code is how to recover from<br clear="none">> > > failures. A classic failure is to perform a checkpoint on a busy system<br clear="none">> > > and then delay too long before running the next invocation of ausearch<br clear="none">> > > and as a result of the delay, the checkpointed event cannot be found in<br clear="none">> > > the files in /var/log/audit. There are other failures, such as re-use of<br clear="none">> >
> inodes etc.<br clear="none">> > > <br clear="none">> > > For those of you who haven't noted the ausearch --checkpoint change, it<br clear="none">> > > basically records the details of the last complete audit event it<br clear="none">> > > processed or printed in a checkpoint file. It records not only the event<br clear="none">> > > time, but also the event node, serial, type and the file device and<br clear="none">> > > inode. Thus, when you next invoke ausearch with this option, the next<br clear="none">> > > event to process is the next complete event since the one recorded.<br clear="none">> > > <br clear="none">> > > Should an error occur when attempting to find the next complete event to<br clear="none">> > > process, ausearch will exit. At this point, I believe the best recovery<br clear="none">> > > action is to extract only the event time from
the checkpoint file and<br clear="none">> > > ask for all complete events after that time (i.e. as opposed to the<br clear="none">> > > usual action of comparing time, event id, type, log file details etc).<br clear="none">> > <br clear="none">> > Would anyone be opposed to making that the default behavior?<br clear="none">> > <br clear="none">> > > There are at last two solutions:<br clear="none">> > > a. We can patch ausearch to take a --checkpoint-time-only flag which<br clear="none">> > > means ausearch will look for all events since the time in the checkpoint<br clear="none">> > > file. This provides the best granularity in time as it goes down to<br clear="none">> > > msecs.<br clear="none">> > <br clear="none">> > I am worried about the proliferation of command line switches. I'd rather<br clear="none">> > make a new --start target. e.g. --start
checkpoint-time.<br clear="none">> > <br clear="none">> > > b. We extract the timestamp from the checkpoint file, convert it to a<br clear="none">> > > date and time and use ausearch's --start option to find all events since<br clear="none">> > > the time in the checkpoint file.<br clear="none">> > > <br clear="none">> > > The first provides greater granularity in time as it goes to msecs.<br clear="none">> > <br clear="none">> > If one is the timestamp of the file, that might be misleading. I don't<br clear="none">> > know if touching a file is an auditable event. No time to investigate<br clear="none">> > right now either. I'd rather see the time taken from within the file.<br clear="none">> > <br clear="none">> > > I can provide a patch. Do you want it?<br clear="none">> > <br clear="none">> > Sure, if its based on a --start target.<br
clear="none">> > <br clear="none">> > -Steve<br clear="none"><br clear="none">--<br clear="none">Linux-audit mailing list<br clear="none"><a shape="rect" ymailto="mailto:Linux-audit@redhat.com" href="mailto:Linux-audit@redhat.com">Linux-audit@redhat.com</a><br clear="none"><a shape="rect" href="https://www.redhat.com/mailman/listinfo/linux-audit" target="_blank">https://www.redhat.com/mailman/listinfo/linux-audit</a><br clear="none"></div><br><br></div> </div> </div> </blockquote><div></div> </div></body></html>