tty events

[Robert Daniels]

I've written an audit plugin to collect statistical data.
I have collected a lot of data over the past few weeks, and the only puzzler
relates to tty data.
I'm using pam_tty_audit and am collecting specific users, including root.

When logged in as root, the tty events are sent to the plugin in near
real-time.
However, when logged in as a user, the events are cached someplace and are
eventually flushed to the dispatcher/plugin.
The other odd thing is the cached user events are in a single event, and is
a collection of multiple tty commands stored into one chunk of data.

I've looked at the source code but do not see where this caching takes
place.
I'd like to know if there is a setting to disable this caching and send the
events in real time, or at least have a way to break these events up, and
acquire a timestamp that matches when the events took place.

Here is a snippet of one of these 'compound' events:

     type=TTY (TTY)
     pid=14778 (14778)
     uid=501 (robert)
     auid=501 (robert)
     major=136 (136)
     minor=3 (3)
     comm="ssh" (ssh)
     data=6563687F7F6E76207C2067726...[truncated]
("ech",<backspace>,<backspace>,"nv | grep SSH",<ret>,"service auditd
stop",<ret>,<up>,<backspace>,<backspace>,"art",<ret>,"su",
ret>,"password",<ret>,"service auditd stop",<ret>,<up>,<backspace>,
<backspace>,"art",<ret>,"ls",<ret>,"p",<backspace>,"ls",<ret>,"exit",
<ret>,"exit",<ret>)

- Robert
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20100908/367931c5/attachment.htm>