<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>On Wed, 2021-01-20 at 17:50 -0500, Paul Moore wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>On Wed, Jan 20, 2021 at 1:38 AM Burn Alting <</pre><a href="mailto:burn.alting@iinet.net.au"><pre>burn.alting@iinet.net.au</pre></a><pre>> wrote:</pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>All,</pre><pre><br></pre><pre>How is the following for a way forward.</pre><pre><br></pre><pre>a. I will author a patch to the user space code to correctly parse this condition and submit it on the weekend. It will be via a new configuration item to auditd.conf just in case placing a fixed extended timeout (15-20 secs) affects memory usage for users of the auparse library. This solves the initial problem of ausearch/auparse failing to parse generated audit.</pre><pre>b. I am happy to instrument what ever is recommended on my hosts at home (vm's and bare metal) to provide more information, should we want to 'explain' the occurrence, given I see this every week or two and report back.</pre></blockquote><pre><br></pre><pre>Seems reasonable to me.</pre><pre><br></pre></blockquote><pre>Steve,</pre><pre><br></pre><pre><div style="font-family: Cantarell; font-size: 12px;">I can implement the 'end_of_event_timeout' change either as</div><div style="font-family: Cantarell; font-size: 12px;"><br></div><div style="font-family: Cantarell; font-size: 12px;">i. a command line argument to ausearch/aureport (say --eoetmo secs) and a new pair of library functions within the auparse() stable (say auparse_set_eoe_timeout() and auparse_get_eoe_timeout())</div><div style="font-family: Cantarell; font-size: 12px;">or</div><div style="font-family: Cantarell; font-size: 12px;"><div>ii. a configuration item in /etc/audit/auditd.conf, or</div><div><br></div></div><div style="font-family: Cantarell; font-size: 12px;">Which is your preference? Mine is i. as this is a user space processing change, not a demon change.</div><div style="font-family: Cantarell; font-size: 12px;"><br></div></pre></body></html>