<div dir="ltr"><div><div><div><div><div><div><div><div>Yes, certainly. </div>I had a 1.7GB messages file in /var/log; so I moved it manually out of the way. Then I rebooted. </div>After doing that, I didn't see anything at all about auditd in the new /var/log/messages. </div>I have finally gotten it down to 13 audit rules, all still Action Rules only for some reason, that are not loading into memory from /etc/audit/audit.rules. </div>Those action rules are using -F path= attributes. </div>What is really interesting is that I have other action rules using -F path= that are getting into memory! </div>These are the files that are not: /usr/libexec/kde4/kdesud /usr/libexec/openssh/ssh-keysign /usr/libexec/polkit-1/polkit-agent-helper-1 /usr/libexec/pt_chown /usr/libexec/utempter/utempter /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper /usr/sbin/lockdev /usr/sbin/postdrop /usr/sbin/postqueue /usr/sbin/suexec /usr/sbin/userhelper /usr/sbin/usernetctl </div>I did the following to evaluate--- for FIL in `cat audit_action_rules_File | grep -v "^#" | awk '{ print $4 }' | cut -d= -f 2`; do echo "Checking for ${FIL}." if [ -f ${FIL} ]; then echo "${FIL} is present." else echo "The file ${FIL} is not present." fi done Checking for /usr/libexec/kde4/kdesud. The file /usr/libexec/kde4/kdesud is not present. Checking for /usr/libexec/openssh/ssh-keysign. /usr/libexec/openssh/ssh-keysign is present. Checking for /usr/libexec/polkit-1/polkit-agent-helper-1. /usr/libexec/polkit-1/polkit-agent-helper-1 is present. Checking for /usr/libexec/pt_chown. /usr/libexec/pt_chown is present. Checking for /usr/libexec/utempter/utempter. /usr/libexec/utempter/utempter is present. Checking for /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper. The file /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper is not present. Checking for /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper. The file /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper is not present. Checking for /usr/sbin/lockdev. /usr/sbin/lockdev is present. Checking for /usr/sbin/postdrop. /usr/sbin/postdrop is present. Checking for /usr/sbin/postqueue. /usr/sbin/postqueue is present. Checking for /usr/sbin/suexec. /usr/sbin/suexec is present. Checking for /usr/sbin/userhelper. /usr/sbin/userhelper is present. Checking for /usr/sbin/usernetctl. /usr/sbin/usernetctl is present. </div>I am still missing all 15 Watch rules in memory. <div><div><div> </div></div></div></div><div class="gmail_extra"> <div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">-------------------------- Warron French </div></div></div> <div class="gmail_quote">On Wed, Apr 12, 2017 at 2:05 PM, Steve Grubb <<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Wednesday, April 12, 2017 1:40:51 PM EDT warron.french wrote: > Didn't know to check there. Shouldn't we keep the discussion on the mail list so others can learn from it? -Steve > Also, I noticed something interesting after tracing through rules I > captured from audit.rules (and sorting) and capturing rules from auditctl > (also sorting). > > Here are some things I observed: > > 1. -a -F path= <path/to/file> are not getting loaded at all. > 2. -a -S call1 -S call2 -S call3 -S callN are being altered into a <div class="HOEnZb"><div class="h5">> relative format of -a -S call1,call2,call3,callN (I was not > expecting this at all). > > I will look at the syslog output from auditctl in /var/log/messages > (correct?). > > > > -------------------------- > Warron French > > On Wed, Apr 12, 2017 at 1:22 PM, Steve Grubb <<a href="mailto:sgrubb@redhat.com">sgrubb@redhat.com</a>> wrote: > > On Wednesday, April 12, 2017 12:51:03 PM EDT warron.french wrote: > > > Hello, I am writing a Puppet Module to deliver updates of audit.rules > > > and > > > auditd.conf configurations to RHEL6 and RHEL7 machines. > > > > > > The files are laid down correctly for both RHEL6 and RHEL7 within the > > > > > > appropriate directories: > > > - RHEL6 = /etc/audit/audit.rules, for > > > - RHEL7 = /etc/audit/rules.d/audit.rules > > > > > > Anyway, the results for all RHEL7 machines (client versus Server) are > > > perfect. The audit.rules are all laid down as expected, and after a > > > > reboot > > > > > of the system the rules are all 100% in place - just as I need. > > > > > > The problem is when they are laid down on RHEL6 clients versus Servers, > > > > the > > > > > behaviors are very different. > > > > > > For RHEL6 clients I have the following intentions and loaded into > > > memory: > > > > > > 118 (-a) Action Rules in audit.rules file 118 Action Rules are > > > loaded into memory (YAY!) > > > > > > * 15 (-w) Watch Rules* in audit.rules file * 15 Watch Rules are > > > loaded into memory* (YAY!) > > > > > > 133 Total Rules in audit.rules files 133 Total Rules into > > > memory (YAY!) > > > > > > > > > For RHEL6 Server; however, I have the following results: > > > > > > 118 (-a) Action Rules in audit.rules file 105 Action Rules are loaded > > > into memory (FAIL) > > > > > > * 15 (-w) Watch Rules* in audit.rules file * 0 Watch Rules are > > > > loaded > > > > > into memory* (HUGE FAIL) > > > > > > 133 Total Rules in audit.rules files 105 Total Rules into > > > > memory > > > > > (YAY!) > > > > > > > > > This is really a big problem for me. Can someone help? > > > > Was there anything in syslog from auditctl? > > > > When auditctl runs across a rule with syntax errors, the default action is > > to > > log it and stop. This way it causes the most noticeable thing to happen. > > However, some people don't like this behavior so they pass a '-c' option > > near > > the beginning of the rules. This causes it to keep processing but > > ultimately > > return an error at exit. Some people didn't like that auditctl returned an > > error, so the '-i' option was created for people that can't be bothered > > with > > failure even in the face of failure. > > > > Check for a syntax error in the rules. It should be in syslog. > > > > -Steve </div></div></blockquote></div> </div>