Troubleshooting Custom audispd Plugin

[Steve Grubb]

On Friday, September 7, 2018 7:30:09 AM EDT Osama Elnaggar wrote:
> Hi,
> 
> I'm working on a custom audispd plugin written in Python 3.  It’s a work in
> progress and I’ve successfully run it numerous times as an audispd plugin.
> However, I sometimes make modifications that result in the audispd plugin
> failing and I end up with the following in /var/log/syslog
> 
> Sep  6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3
> terminated unexpectedly
> Sep  6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3 was
> restarted
> ...
> 
> This is repeated several times until audispd gives up and I see the
> following message:
> 
> Sep  6 20:52:14 ubuntu-hypervisor audispd: plugin /usr/bin/python3 has
> exceeded max_restarts
> 
> To troubleshoot, I modify my code to read from /var/log/audit/audit.log
> instead.  I modify a single line (with fileinput.input() to read from
> myfile as shown in the commented line below).
> 
> Here is the code snippet (a colorized easier to read version is available
> here - https://pastebin.com/84Nxu3Rp):
> 
> # let us initialize the AuParser
> aup = auparse.AuParser(auparse.AUSOURCE_FEED)
> 
> # we initalize the callback to be fn_process_event
> aup.add_callback(fn_process_event, None, None)
> 
> myfile = "/var/log/audit/audit.log"
> 
> while True:
>     try:
>         # we read in line by line from stdin
>         for line in fileinput.input():
>         #for line in fileinput.input(myfile):
>             aup.feed(line)
>     except:
>         logger.error("Fatal error in while loop", exc_info=True)
> 
> # we flush the feed when we quit
> aup.flush_feed()
> 
> Any suggestions on how to troubleshoot these types of issues when reading
> from a file works fine without issue but running it as a plugin fails as
> shown in /var/log/syslog?  Thanks.

All plugins have a requirement to take events from stdin. As long as it 
expects strings (which is the way that auparse wants them), then all you have 
to do is:

ausearch --start boot --raw | ./plugin

You can also save raw logs with ausearch and cat them into the plugin. This 
is helpful when you get a problem down to a certain series of events and you 
don't want to go through a thousand events before the problem sequence.

-Steve