<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Dear all,</div><div class=""><br class=""></div><div class="">We are developing custom user space audit agent to gather system wide system</div><div class="">call trace. While experimenting with various programs, we found out that</div><div class="">processes (daemons) that started early (along with the system bootstrapping) do</div><div class="">not report any audit events at all. These processes typically fall into PID</div><div class="">range of less than 2000. Here’s how I reproduced the symptom with sshd daemon.</div><div class=""><br class=""></div><div class=""><b class="">1. Reboot the system</b></div><div class=""><br class=""></div><div class=""><b class="">2. Add and enable audit events</b></div><div class=""> # /sbin/auditctl -a exit,always -F arch=b64 -S clone -S close -S creat -S dup</div><div class=""> -S dup2 -S dup3 -S execve -S exit -S exit_group -S fork -S open -S openat </div><div class=""> -S unlink -S unlinkat -S vfork -S 288 -S accept -S bind -S connect </div><div class=""> -S listen -S socket -S socketpair</div><div class=""> # /sbin/auditctl -e1 -b 102400</div><div class=""><br class=""></div><div class=""><b class="">3. Connect to the system via ssh</b></div><div class=""> Audit messages generated only from child processes and none are seen from</div><div class=""> the original daemon.</div><div class=""><br class=""></div><div class=""><b class="">4. Restart sshd </b></div><div class=""> # restart ssh</div><div class=""><br class=""></div><div class=""><b class="">5. Connect again to the system via ssh</b></div><div class=""> Now, we see audit messages from both parent and child processes.</div><div class=""><br class=""></div><div class="">I did the experiment from Ubuntu 14.04.2 LTS distribution (64-bit, kernel</div><div class="">version 3.13.0-58-generic).</div><div class=""><br class=""></div><div class="">I first wonder whether this is intended behavior of audit framework or</div><div class="">not. If it is intended, I also want to know how can we configure auditd</div><div class="">differently to capture system calls from all processes. </div><div class=""><br class=""></div><div class="">Thanks a lot for your help in advance!</div><div class=""><br class=""></div><div class="">Regards, Kangkook</div><div class=""><br class=""></div></body></html>