Config_change events

[Steve Grubb]

On Monday, December 30, 2019 12:21:15 PM EST MAUPERTUIS, PHILIPPE wrote:
> When I issue a service auditd restart, I get the following events :
> [root at xxxxxxxx ~]# ausearch -k 10.5.5-modification-audit -ts recent
> --format raw node=xxxxxxxx type=CONFIG_CHANGE
> msg=audit(1577725960.912:8745):  auid=4294967295 ses=4294967295
> op=remove_rule key="10.5.5-modification-audit" list=4 res=1AUID="unset"
> node=xxxxxxxx type=CONFIG_CHANGE msg=audit(1577725960.947:8777): 
> auid=4294967295 ses=4294967295 op=add_rule key="10.5.5-modification-audit"
> list=4 res=1AUID="unset"
> 
> How can I link this event to the daemon_start daemon_end events ?

The best way is by a time window. Did it occur within a second of the audit 
daemon starting or stopping?

> How can I trace the CONFIG_CHANGE events to a user action ?

You would have to place a watch on auditctl. In this particular case, auid 
and session are -1, which means a daemon did it.

> Are the Daemon_start and daemon_end events specifically linked to auditd ?

Yes.

-Steve