How to monitor audit/audispd killed

[Steve Grubb]

On Tuesday, January 05, 2016 03:29:31 AM Matthew Chao wrote:
> >You have a race condition where auditd gets a signal to shutdown and an
> event indicating that shutdown is occurring. On shutdown, the audit daemon
> does not alter the rules or whether auditing is enabled. (This was to get
> shutdown AVCs for selinux.) There is a chance that your event is in syslog's
> files.
> 
> For clarity, I am still not sure whether audit rules can be written to
> monitor auditd/auispd killed or not (syslog was disabled under my
> circumstances ).

You cannot audit the audit daemon's pid. Otherwise servicing an event could 
create several more events which cause even more and you get an exponential 
increase in logging until it dies.

You can watch audispd, but I don't think that will help anything.


> If yes, could you give me some tips? Thanks.

The audit daemon is required to log some information about why it shutdown. If 
you have a daemon_end event, this is the required information. Is there 
something not in the event that you need?

-Steve