filtering out audit output

[Steve Grubb]

On Tuesday, February 01, 2011 02:34:23 pm Levy, Mark (IT Solutions) wrote:
> Hi, I'm trying to find a way to filter out some of the excess output from
> netiq which does a df every 10 seconds. I haven't had any success yet and
> was hoping someone could point me the right direction. Below is the output
> that I would like to filter out.
> 
>   node=newman.netiq.northgrum.com type=CWD msg=audit(02/01/2011
> 01:26:09.976:336030) :  cwd=/usr/netiq/vsau/bin
> node=newman.netiq.northgrum.com type=EXECVE msg=audit(02/01/2011
> 01:26:09.976:336030) : argc=(null) a0=/bin/df a1=-kP a2=../local/spool
> node=newman.netiq.northgrum.com type=SYSCALL msg=audit(02/01/2011
> 01:26:09.976:336030) : arch=x86_64 syscall=execve per=400000 success=yes
> exit=0 a0=7fffe76acc58 a1=7fffe76aa af8 a2=603c90 a3=0 items=2 ppid=3465
> pid=9347 auid=unset uid=root gid=root euid=root suid=root fsuid=root
> egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=df exe
> =/bin/df key=(null)
> ----

This looks like you have an audit rule for execve. Do you have some reason to audit 
execve? If not, I would place watches on the programs you care about and not capture 
all execve. Or do you care about programs that users run rather than the system 
running? In that case, I would restrict the execve to auid>=500 and  auid!=4294967295. 
If you just don't want df, near the top try this:

-a exit,never -F path=/bin/df -F perm=x

It has to be before the rule that triggers the execve because the audit system has a 
first match wins rule engine. You may need a recent kernel for that to work as it did 
not work as intended at first.

-Steve