[PATCH] auvirt: a new tool for reporting events related to virtual machines
Marcelo Cerri
mhcerri at linux.vnet.ibm.com
Fri Jan 27 16:37:00 UTC 2012
I submitted a patch to libvirt to add the qemu pid (vm-pid) to the
VIRT_CONTROL audit record.
I'm using this field to correlate anomaly events to guest in auvirt and
as a fallback it tries to use the SELinux context for that.
Regards,
Marcelo
On 01/25/2012 10:56 AM, Marcelo Cerri wrote:
> I agree that pid and time is a better way for correlation but I was
> coding a solution based on that when I figured out a problem. There's
> no qemu pid in the audit logs. Libvirt (at least the libvirt shipped
> with RHEL 6.2) always logs its own pid to the audit log.
>
> I'll try to discover if there is another way to correlate them or if
> newer versions of libvirt log the qemu pid to the audit log.
>
> Regards,
> Marcelo
>
> On 01/24/2012 06:27 PM, Steve Grubb wrote:
>> On Tuesday, January 24, 2012 01:08:56 PM Marcelo Cerri wrote:
>>> I took a look at some anomaly events and I'm thinking to correlate them
>>> to guests based on the SELinux context or maybe based on the pid field.
>>>
>>> Do you think there is another ways to correlate them?
>> I was thinking to correlate them based on the time and pid. If its
>> within the
>> time range between startup/shutdown and its the same pid, then you
>> have the
>> event correlated. If its outside the time range or a different pid,
>> then you do
>> not have correlation. I would not look at selinux label because not all
>> systems/distros have it enabled or compiled in. So, pid and time are
>> the most
>> universal identifiers for correlation.
>>
>> -Steve
>>
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
More information about the Linux-audit
mailing list