[PATCH] auvirt: a new tool for reporting events related to virtual machines
Marcelo Cerri
mhcerri at linux.vnet.ibm.com
Fri Jan 13 17:25:05 UTC 2012
Hi,
These are some output examples of auvirt. What do you think?
I just added a "--full" option because libvirt can generate several
resource events and this can make the output confusing.
Regards,
Marcelo
------
$ ./auvirt
start guest-name-1 root Tue Jan 10 11:05
stop guest-name-1 root Tue Jan 10 11:39
start guest-name-2 root Wed Jan 11 15:23
start guest-name-2 root Wed Jan 11 16:28
start guest-name-1 root Wed Jan 12 19:47
$ ./auvirt --show-uuid
start guest-name-1 fb4149f5-9ff6-4095-f6d3-a1d03936fdfa root Tue Jan
10 11:05
stop guest-name-1 fb4149f5-9ff6-4095-f6d3-a1d03936fdfa root Tue Jan
10 11:39
start guest-name-2 f937029b-93ca-4e13-b40b-663f46323503 root Wed Jan
11 15:23
start guest-name-2 f937029b-93ca-4e13-b40b-663f46323503 root Wed Jan
11 16:28
start guest-name-1 fb4149f5-9ff6-4095-f6d3-a1d03936fdfa root Wed Jan
12 19:47
$ ./auvirt --summary # keep the same behaviour
$ ./auvirt --uuid fb4149f5-9ff6-4095-f6d3-a1d03936fdfa
start guest-name-1 root Tue Jan 10 11:05
stop guest-name-1 root Tue Jan 10 11:39
start guest-name-1 root Wed Jan 12 19:47
$ ./auvirt --vm-name guest-name-2
start guest-name-2 root Wed Jan 11 15:23
start guest-name-2 root Wed Jan 11 16:28
$ ./auvirt --full --uuid f937029b-93ca-4e13-b40b-663f46323503
res guest-name-2 root Wed Jan 11 15:23 disk "?"
"/images/guest-2.img"
res guest-name-2 root Wed Jan 11 15:23 vcpu "0" "4"
res guest-name-2 root Wed Jan 11 15:23 net "?"
"52:54:00:DB:AE:B4"
res guest-name-2 root Wed Jan 11 15:23 mem "?" "1048576"
start guest-name-2 root Wed Jan 11 15:23
avc guest-name-2 root Wed Jan 11 19:49 read
"/images/guest-2.img" denied
res guest-name-2 root Wed Jan 11 15:23 mem "1048576"
"2097152"
stop guest-name-2 root Wed Jan 11 16:28
$ ./auvirt --full # same as above but showing events related to all guests
On 01/11/2012 07:48 PM, Steve Grubb wrote:
> On Monday, January 09, 2012 12:00:32 PM Marcelo Cerri wrote:
>> Just another question.
>>
>> Currently, auvirt has two different modes defined by the options
>> "--summary" and "--raw". In your last email, you suggested that summary
>> would be laid out like the aulast program.
>
> Yeah, I was thinking of something like a timeline so that you can what happened
> to resources and in what order. It just so happens aulast is also a time line of
> system boots and logins. When it comes to a virt guest, I would want to see it
> boot, things assigned, things removed, anything funny happening to it, and then
> it shutting down. I also think the host being booted/shutdown might ought to be
> in there, too.
>
>
>> Do you think that would be a good idea to have a option to output all the
>> matched records, as in "--raw", but using a layout similar to aulast too?
>
> I think you want both a concise report and the ability to pull the just records
> that made up the report. Aulast does this by having a proof mode that instead of
> giving you the records, it tells you how to pull them with ausearch.
>
> -Steve
>
>
>> On 01/05/2012 02:44 PM, Marcelo Cerri wrote:
>>> Hi Steve,
>>>
>>> Thanks for you feedback.
>>>
>>> I'm already updating the source code based on your comments and
>>> looking for another events that may be correlated to a VM.
>>>
>>> But I'm not sure what means "anomaly events". Would it be malformed
>>> records (without some fields, for example) or a specific record type
>>> generated by the kernel or some other userspace application?
>>>
>>> Regards,
>>> Marcelo
>>>
>>> On 12/20/2011 04:18 PM, Steve Grubb wrote:
>>>> On Thursday, December 15, 2011 10:56:51 AM Marcelo Cerri wrote:
>>>>> This patch adds a new tool to extract information related to virtual
>>>>> machines from the audit log files. It can output a summary with
>>>>> information about the number of events found with details by type of
>>>>> record and operation. The tool can also output the filtered records as
>>>>> found in the audit log.
>>>>>
>>>>> Using the --avc option auvirt tries to correlate AVC records to the
>>>>> guests
>>>>> based on its security context. It's also possible to select records
>>>>> related
>>>>> to just one guest using the UUID or the guest name.
>>>>
>>>> I'm wondering about this tool. It runs fine. But I thought you were
>>>> wanting to do
>>>> some more sophisticated analysis of events. For example this is the
>>>> current
>>>> output:
>>>>
>>>> $ ./auvirt --file ../../../virt-audit.log
>>>> Total records: 6
>>>> Virt records: 6
>>>> Resource records: 4
>>>> Machine ID records: 1
>>>> AVC records: 0
>>>>
>>>> Operations:
>>>> Start: 1
>>>> Stop: 0
>>>>
>>>> Considered time:
>>>> Start: Tue Dec 20 09:33:01 2011
>>>> End: Tue Dec 20 09:33:01 2011
>>>>
>>>> This is not much different than what can be reported by
>>>> ausearch/report with the
>>>> new uuid and vm search fields. Also, testing with the uuid number
>>>> doesn't seem to
>>>> get any hits. But using the vm name does.
>>>>
>>>> I plan to add a very basic virt report to aureport soon. I was
>>>> wondering if the
>>>> above is all anyone really wanted to see? I would think that perhaps
>>>> you want
>>>> some info about start/stop assignment of resources, changes in
>>>> resources, and
>>>> perhaps MAC or anomaly events related to a vm. But laid out like the
>>>> aulast
>>>> program.
>>>>
>>>> boot vm-name time (total runtime)
>>>> resource what-kind old-value new-value time (total time assigned)
>>>> avc access-type obj results time
>>>> shutdown vm-name time
>>>>
>>>> and there might be other audit events associated with a vm.
>>>>
>>>> -Steve
>
More information about the Linux-audit
mailing list