Filtering out non-interactive users

[Steve Grubb]

On Friday, January 14, 2011 11:37:01 am PJB wrote:
> I've recently been working on a number of systems that need to fulfill
> auditing requirements for things such as "failed program executions,"
> "failed file/directory deletions" and such, and we have been attempting to
> use auditd to fulfill these requirements. However we've been having
> difficulty filtering out the 'noise' from non-interactive processes since
> our requirements only need us to capture these events for real human
> users.
> 
> In older versions of the audit code, we used the following type of system
> call auditing rule which seemed to work pretty well:
> 
> -a exit,always -S creat -S open -S openat -S truncate -S ftruncate -F
> success=0 -F auid!=-1

This rule looks correct except that if you have a 64 bit system,  I would suggest a -F 
arch=b32 between the '-a' and '-S' and then another copy of the rule for the 64 bit 
arch.
 
> Filtering on an 'auid!=-1' seemed to do a very good job of stripping out
> system calls from daemon processes and such. However at some point I guess
> this was changed because we no longer seem to be able to capture any
> system calls at all when we have this filter defined on a rule.

That should work. I'd try listing the rules back out to see if something is getting 
mis-translated going into the kernel.
 
> Can someone point me to documentation/examples or help me out with the
> proper syntax for setting up rules that will exclude the background
> processes? We are using auditd 1.7.4 now and the 'auid' filter above no
> longer does the job.

There's been a lot of bugs fixed since then. You might try building a newer auditctl 
and trying it out to see if that makes a difference. Also note that the event capturing 
is done by the kernel and the kernel version would matter more than the auditd 
version.

Are you getting other events like logins? Just making sure your disk isn't full or 
something else. And when you do auditctl -s, it shows the audit system is enabled?

-Steve