Occasional delayed output of events

[Steve Grubb]

On Monday, January 25, 2021 7:11:45 PM EST Burn Alting wrote:
> On Mon, 2021-01-25 at 18:53 -0500, Steve Grubb wrote:
> > On Saturday, January 23, 2021 5:55:44 PM EST Burn Alting wrote:
> > > > > How is the following for a way forward.
> > > > > a. I will author a patch to the user space code to correctly parse
> > > > > this
> > > > > condition and submit it on the weekend. It will be via a new
> > > > > configuration item to auditd.conf just in case placing a fixed
> > > > > extended timeout (15-20 secs) affects memory usage for users of the
> > > > > auparse library. This solves the initial problem of
> > > > > ausearch/auparse
> > > > > failing to parse generated audit.b. I am happy to instrument what
> > > > > ever
> > > > > is recommended on my hosts at home (vm's and bare metal) to provide
> > > > > more information, should we want to 'explain' the occurrence, given
> > > > > I
> > > > > see this every week or two and report back.
> > > > 
> > > > Seems reasonable to me.
> > > 
> > > I can implement the 'end_of_event_timeout' change either as
> > > i. a command line argument to ausearch/aureport (say --eoetmo secs) and
> > > a
> > > new pair of library functions within the  auparse() stable (say
> > > auparse_set_eoe_timeout() and auparse_get_eoe_timeout())
> > > or
> > > ii. a configuration item in /etc/audit/auditd.conf, or
> > > 
> > > 
> > > Which is your preference? Mine is i. as this is a user space processing
> > > change, not a demon change.
> > 
> > To be honest, I'm not entirely sure what we're seeing. I run some tests
> > today on my system. It's seeing issues also. I'd still like to treat the
> > root cause of this. But we do need to change the default. That I what
> > I'm trying to figure out.
> > 
> > Back to your question, I'm wondering if we should do both? A changeable
> > default in auditd.conf and an override on the command line.
> 
> So far, all items in /etc/audit/auditd.conf appear to only affect the
> daemon. Is this the right location to start adding non-daemon
> configuration items? (I accept there is no other place).

ausearch/report/auparse all read the auditd.conf to find the canonical 
location for where the logs are supposed to be. So, they already read this 
file. I'd rather keep it there than make yet another config. The only drawback 
it that it might again confuse people that auditd really doesn't do anything 
with the records but just some light processing.

-Steve

> Happy to do both, if required.
> 
> > -Steve