audit-tools and SUDO

[Steve Grubb]

On Tuesday, May 10, 2016 01:44:50 PM Warron S French wrote:
> > > I have two problems though; and they seem somewhat minor:
> > > 
> > > 1.      The audit events being captured don’t seem to be tied to any
> > > given node (so that I can perform ausearch --node hostName, or 
> > > aureport), that’s the first issue.
> > 
> > 
> > What have you set the configuration parameter 'name_format'
> > in /etc/audit/auditd.conf to?
> > 
> > One assumes you may want to set
> > name_format = fqd
> > or
> > name_format = hostname
> > 
> > After the change on each host, don't forget to reload the 
> > configuration with either a sighup on the auditd process or just restart
> > the service.
> 
> On the lab-clients ends:
> In, and ONLY IN, my /etc/audisp/audispd.conf file have I set
> name_format=hostname, where hostname is a literal string of 'hostname' not
> THE hostname; 

This is correct. Did you set remote_server in /etc/audisp/audisp-remote.conf?


> there is no name_format reference in any other file on my
> lab-client machines under the directory /etc/audisp/ anywhere.  Also on my
> lab-client machines in the /etc/audit/auditd.conf file the name_format
> variable is set to NONE.  
>
> On the lab-server end:
> In the only file that I modified, /etc/audit/auditd.conf, the only variables
> that I altered were:
> tcp_listen_port   = 60
> tcp_client_ports = 60
> use_libwrap         = no  (because I am using iptables)

You would want to set name_format. This way the local events on the 
aggregating server have the same format.


 
> The lab works as expected, but my production environment does not.  %-/

I would start by checking that events are coming out of the remote systems. 
You can use tcpdump port 60 on the clients. After confirming that, do the same 
on the server to see if events are getting there. Then look in syslog for 
anything that might give a clue. And then you can also tail -f 
/var/log/audit/audit.log to see if things are getting written to disk.

-Steve