<div dir="ltr"><div>Hello Experts,</div><div><br></div><div>We have a big customer that facing the following issue on RHEL 6.2.<br></div><div>As per customer request I've configured the following rules:</div><div><br></div><div><pre class="gmail-caseCommentStyle" dir="auto">$ cat audit.rules
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.
# First rule - delete all
-D
# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320
# Feel free to add below this line. See auditctl man page
-a exit,always -F arch=b64 -F euid=0 -S execve -k rootact
-a exit,always -F arch=b32 -F euid=0 -S execve -k rootact
-a exit,always -F arch=b64 -F euid>=500 -S execve -k useract
-a exit,always -F arch=b32 -F euid>=500 -S execve -k useract</pre></div><div><br></div><div>Audit start working as expected. Now customer is asking to exclude/ignore the following from audit logs:<br></div><div><br></div><div><pre class="gmail-caseCommentStyle" dir="auto">type=SYSCALL msg=audit(1581664357.597:257516): arch=c000003e syscall=59 success=yes exit=0 a0=3869161ea3 a1=7ffd15530c20 a2=7ffd15534348 a3=3869617240 items=2 ppid=3350 pid=59266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" key="rootact"
type=EXECVE msg=audit(1581664357.597:257516): argc=3 a0="sh" a1="-c" a2=2F62696E2F70732061757877777777
type=CWD msg=audit(1581664357.597:257516): cwd="/opt/microfocus/Discovery/bin"
type=PATH msg=audit(1581664357.597:257516): item=0 name="/bin/sh" inode=398 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1581664357.597:257516): item=1 name=(null) inode=4481 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL</pre></div><div><pre class="gmail-caseCommentStyle" dir="auto">ype=SYSCALL msg=audit(1581664357.601:257517): arch=c000003e syscall=59 success=yes exit=0 a0=155c2f0 a1=155b8d0 a2=155b460 a3=18 items=2 ppid=3350 pid=59266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ps" exe="/bin/ps" key="rootact"
type=EXECVE msg=audit(1581664357.601:257517): argc=2 a0="/bin/ps" a1="auxwwww"
type=CWD msg=audit(1581664357.601:257517): cwd="/opt/microfocus/Discovery/bin"
type=PATH msg=audit(1581664357.601:257517): item=0 name="/bin/ps" inode=1451 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1581664357.601:257517): item=1 name=(null) inode=4481 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL</pre></div><div>What would be the best way to exclude such audit?<br></div><div>Your help would be much appreciated.</div><div><br></div><div>Thanks in advance & kind regards,</div><div>Moshe<br></div><div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div style="margin-left:44px"><div style="margin-bottom:0px;margin-left:0px;padding-bottom:5px"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><p style="margin:0px;font-weight:bold;padding:0px;font-size:14px;text-transform:capitalize;font-family:RedHatText,sans-serif">Moshe Rechtman<span style="color:rgb(170,170,170);margin:0px"></span></p><p style="margin:0px;font-size:14px;color:rgb(0,0,0);font-family:overpass,sans-serif;font-weight:bold;padding:0px;text-transform:uppercase"><span style="font-family:RedHatText,sans-serif;font-size:12px;text-transform:capitalize;font-weight:normal;color:rgb(34,34,34)">Technical Support Engineer</span><br></p></div></div></div></div></div></div></div></div></div></div><div style="margin-left:44px"><div style="margin-bottom:0px;margin-left:0px;padding-bottom:5px"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><p style="margin:0px 0px 4px;font-size:12px;font-family:RedHatText,sans-serif"><a href="https://www.redhat.com/" style="color:rgb(0,136,206);margin:0px" target="_blank">Red Hat Israel</a></p><div style="margin-bottom:4px"><p style="margin:0px;font-size:12px;font-family:RedHatText,sans-serif">34 Jerusalem rd. Ra'anana, 43501</p></div><p style="margin:0px"><span style="font-family:RedHatText,sans-serif;font-size:12px;margin:0px;padding:0px"><u><a href="mailto:kweg@redhat.com" style="color:rgb(17,85,204)" target="_blank">mrechtma@redhat.com</a> </u> </span><font face="RedHatText, sans-serif"><span style="font-size:12px"> T: </span></font><u style="font-family:RedHatText,sans-serif;font-size:12px">+972-9-</u><font face="RedHatText, sans-serif"><span style="font-size:12px"><u>7692289 </u></span></font><br><font face="RedHatText, sans-serif"><span style="font-size:12px">M: </span></font><u style="font-family:RedHatText,sans-serif;font-size:12px"><span>+972-54-4971516</span></u><font face="RedHatText, sans-serif"><span style="font-size:12px"> F: </span></font><a href="tel:+972-9-7692223" style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:12px;margin:0px" target="_blank">+972-9-7692223</a><font face="RedHatText, sans-serif"><span style="font-size:12px"> </span></font></p><div style="font-size:12px;font-family:RedHatText,sans-serif;margin-bottom:8px"><a href="https://twitter.com/redhat" title="twitter" style="color:rgb(0,0,0);background:transparent url("https://marketing-outfit-prod-images.s3-us-west-2.amazonaws.com/3780bd4ede961ef3cd4108b8c0e80186/web-icon-twitter.png") no-repeat scroll 0px 50%/13px auto;display:inline-block;line-height:20px;padding-left:13px" target="_blank"><span style="margin-left:2px">@RedHat</span></a> <a href="https://www.linkedin.com/company/red-hat" title="LinkedIn" style="color:rgb(0,0,0);background:transparent url("https://marketing-outfit-prod-images.s3-us-west-2.amazonaws.com/8d3507e3c6b6c9ad10e301accf1a4af0/web-icon-linkedin.png") no-repeat scroll 0px 50%/12px auto;display:inline-block;line-height:20px;padding-left:12px;margin:0px 4px 0px 3px;padding-top:1px" target="_blank"><span style="margin-left:4px">Red Hat</span></a> <a href="https://www.facebook.com/RedHatInc" title="Facebook" style="color:rgb(0,0,0);background:transparent url("https://marketing-outfit-prod-images.s3-us-west-2.amazonaws.com/220b85e2f100025e94cb1bcd993bd51d/web-icon-facebook.png") no-repeat scroll 0px 50%/11px auto;display:inline-block;line-height:20px;padding-left:13px" target="_blank">Red Hat</a></div><div style="margin-top:12px"><table border="0"><tbody><tr><td width="100px"><a href="https://red.ht/sig" style="color:rgb(17,85,204)" target="_blank"><img src="https://static.redhat.com/libs/redhat/brand-assets/latest/corp/logo.png" width="90" height="auto"></a></td></tr></tbody></table></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>