Should open syscall records occur without a path record?
John D. Ramsdell
ramsdell at mitre.org
Tue Jul 24 12:06:44 UTC 2007
Steve Grubb <sgrubb at redhat.com> writes:
> setroubleshoot is written in python and it sorts its input stream to solve
> this in the mean time. You might look there for some example code.
I was unable to find the relevant code with a quick look, but I didn't
take much time as I knew a short script would to do the trick. I just
sorted on the serial numbers in the audit message. Diff'ing showed
quite a bit of motion in the sorted output. Also, I notice that in
just one message, the msg field value does not end with a colon:
type=DAEMON_START msg=audit(1185203485.586:824) auditd start, ver=1.5.5, format=raw, auid=500 pid=24638 res=success, auditd pid=24638
John
#! /bin/sh
python -E -c '
import sys, re
def main():
pattern = re.compile("\smsg=audit\(\d+\.\d+:(\d+)\):?\s")
for line in sys.stdin:
match = pattern.search(line)
if not match:
sys.stderr.write("cannot parse audit message: '\''%s'\''\n" % line)
sys.exit(1)
sys.stdout.write(match.group(1) + "\t" + line)
if __name__ == "__main__":
main()
' | sort -n -s -k 1 | cut -f 2-
More information about the Linux-audit
mailing list