audit.rules not fully loading into memory according to auditctl -l

[warron.french]

OK, I will have to try this tomorrow.  I have to go home now.


--------------------------
Warron French


On Wed, Apr 12, 2017 at 5:01 PM, Steve Grubb <sgrubb at redhat.com> wrote:

> On Wednesday, April 12, 2017 3:00:59 PM EDT warron.french wrote:
> > Yes, certainly.
> >
> > I had a 1.7GB messages file in /var/log; so I moved it manually out of
> the
> > way.  Then I rebooted.
> >
> > After doing that, I didn't see anything at all about auditd in the new
> > /var/log/messages.
>
> It will probably be auditctl rather than auditd. Auditctl is noisy on any
> problems, try loading the rules by hand:
>
> auditctl -R /etc/audit/audit.rules
>
> -Steve
>
> > I have finally gotten it down to 13 audit rules, all still Action Rules
> > only for some reason, that are not loading into memory from
> > /etc/audit/audit.rules.
> > Those action rules are using -F path= attributes.
> >
> > What is really interesting is that I have other action rules using -F
> path=
> > that are getting into memory!
> >
> > These are the files that are not:
> > /usr/libexec/kde4/kdesud
> > /usr/libexec/openssh/ssh-keysign
> > /usr/libexec/polkit-1/polkit-agent-helper-1
> > /usr/libexec/pt_chown
> > /usr/libexec/utempter/utempter
> > /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
> > /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
> > /usr/sbin/lockdev
> > /usr/sbin/postdrop
> > /usr/sbin/postqueue
> > /usr/sbin/suexec
> > /usr/sbin/userhelper
> > /usr/sbin/usernetctl
> >
> > I did the following to evaluate---
> > for FIL in `cat audit_action_rules_File | grep -v "^#" | awk '{ print $4
> }'
> >
> > | cut -d= -f 2`; do
> >
> >    echo "Checking for ${FIL}."
> >    if [ -f ${FIL} ]; then
> >       echo "${FIL} is present."
> >    else
> >       echo "The file ${FIL} is not present."
> >    fi
> > done
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20170412/679fb22a/attachment.htm>