Why aren't SYSCALLS being logged in CentOS kernel (any ideas?)
Robert Evans
bob.evans at jhuapl.edu
Fri Aug 31 15:40:07 UTC 2007
Hi,
I'm using CentOS, kernel 2.6.18-8.el5. I've compiled audit-1.5.6-1 and I'm
getting USER_AUTH events (logins, su, etc...) but I'm not seeing any syscall events.
My test audit.rules works fine in RHEL4, Suse10 and Fedora, but doesn't seem to
generate any syscall events in CentOS 5. For testing purposes, I'm using the
following in audit.rules:
# Log execute failures
-a exit,always -S execve -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F
exit!=-6
# Log administrative functions
-a exit,always -S reboot -S clock_settime -S settimeofday -S adjtimex -S
setdomainname -S sethostname -S reboot -S mount -S umount2
-a exit,always -S swapon -S swapoff -S create_module -S delete_module -S
quotactl -F success!=1
# Log Read/Write functions
-a exit,always -S open -S creat -S link -S symlink -S truncate -S ftruncate -S
mknod -S rename -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6
# Log file removal failures
-a exit,always -S unlink -S rmdir -F success!=1 -F exit!=-2 -F exit!=-20 -F
exit!=-17 -F exit!=-6
# Log file modification failures
-a exit,always -S chmod -S chown -S lchown -S fchmod -S fchown -F success!=1 -F
exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6
# Add watches for reboot stuff...
-w /sbin/init -p x -k runlevel
-w /sbin/telinit -p x -k runlevel
-w /sbin/halt -p x -k runlevel
-w /sbin/poweroff -p x -k runlevel
-w /sbin/reboot -p x -k runlevel
-w /sbin/shutdown -p x -k runlevel
Any ideas?
Bob
More information about the Linux-audit
mailing list