[PATCH] auvirt: a new tool for reporting events related to virtual machines
Marcelo Cerri
mhcerri at linux.vnet.ibm.com
Thu Jan 5 16:44:57 UTC 2012
Hi Steve,
Thanks for you feedback.
I'm already updating the source code based on your comments and looking
for another events that may be correlated to a VM.
But I'm not sure what means "anomaly events". Would it be malformed
records (without some fields, for example) or a specific record type
generated by the kernel or some other userspace application?
Regards,
Marcelo
On 12/20/2011 04:18 PM, Steve Grubb wrote:
> On Thursday, December 15, 2011 10:56:51 AM Marcelo Cerri wrote:
>> This patch adds a new tool to extract information related to virtual
>> machines from the audit log files. It can output a summary with
>> information about the number of events found with details by type of
>> record and operation. The tool can also output the filtered records as
>> found in the audit log.
>>
>> Using the --avc option auvirt tries to correlate AVC records to the guests
>> based on its security context. It's also possible to select records related
>> to just one guest using the UUID or the guest name.
> I'm wondering about this tool. It runs fine. But I thought you were wanting to do
> some more sophisticated analysis of events. For example this is the current
> output:
>
> $ ./auvirt --file ../../../virt-audit.log
> Total records: 6
> Virt records: 6
> Resource records: 4
> Machine ID records: 1
> AVC records: 0
> Operations:
> Start: 1
> Stop: 0
> Considered time:
> Start: Tue Dec 20 09:33:01 2011
> End: Tue Dec 20 09:33:01 2011
>
> This is not much different than what can be reported by ausearch/report with the
> new uuid and vm search fields. Also, testing with the uuid number doesn't seem to
> get any hits. But using the vm name does.
>
> I plan to add a very basic virt report to aureport soon. I was wondering if the
> above is all anyone really wanted to see? I would think that perhaps you want
> some info about start/stop assignment of resources, changes in resources, and
> perhaps MAC or anomaly events related to a vm. But laid out like the aulast
> program.
>
> boot vm-name time (total runtime)
> resource what-kind old-value new-value time (total time assigned)
> avc access-type obj results time
> shutdown vm-name time
>
> and there might be other audit events associated with a vm.
>
> -Steve
>
More information about the Linux-audit
mailing list