Occasional delayed output of events

[Burn Alting]

On Mon, 2021-01-25 at 19:20 -0500, Steve Grubb wrote:
> On Monday, January 25, 2021 7:11:45 PM EST Burn Alting wrote:
> > On Mon, 2021-01-25 at 18:53 -0500, Steve Grubb wrote:
> > > On Saturday, January 23, 2021 5:55:44 PM EST Burn Alting wrote:
> > > > > > How is the following for a way forward.
> > > > > > a. I will author a patch to the user space code to correctly parse
> > > > > > this
> > > > > > condition and submit it on the weekend. It will be via a new
> > > > > > configuration item to auditd.conf just in case placing a fixed
> > > > > > extended timeout (15-20 secs) affects memory usage for users of the
> > > > > > auparse library. This solves the initial problem of
> > > > > > ausearch/auparse
> > > > > > failing to parse generated audit.b. I am happy to instrument what
> > > > > > ever
> > > > > > is recommended on my hosts at home (vm's and bare metal) to provide
> > > > > > more information, should we want to 'explain' the occurrence, given
> > > > > > I
> > > > > > see this every week or two and report back.
> > > > > 
> > > > > Seems reasonable to me.
> > > > 
> > > > I can implement the 'end_of_event_timeout' change either as
> > > > i. a command line argument to ausearch/aureport (say --eoetmo secs) and
> > > > a
> > > > new pair of library functions within the  auparse() stable (say
> > > > auparse_set_eoe_timeout() and auparse_get_eoe_timeout())
> > > > or
> > > > ii. a configuration item in /etc/audit/auditd.conf, or
> > > > 
> > > > 
> > > > Which is your preference? Mine is i. as this is a user space processing
> > > > change, not a demon change.
> > > 
> > > To be honest, I'm not entirely sure what we're seeing. I run some tests
> > > today on my system. It's seeing issues also. I'd still like to treat the
> > > root cause of this. But we do need to change the default. That I what
> > > I'm trying to figure out.
> > > 
> > > Back to your question, I'm wondering if we should do both? A changeable
> > > default in auditd.conf and an override on the command line.
> > 
> > So far, all items in /etc/audit/auditd.conf appear to only affect the
> > daemon. Is this the right location to start adding non-daemon
> > configuration items? (I accept there is no other place).
> 
> ausearch/report/auparse all read the auditd.conf to find the canonical 
> location for where the logs are supposed to be. So, they already read this 
> file. I'd rather keep it there than make yet another config. The only drawback 
> it that it might again confuse people that auditd really doesn't do anything 
> with the records but just some light processing.

OK. I will put it in /etc/audit/auditd.conf


> -Steve
> 
> > Happy to do both, if required.
> > 
> > > -Steve
> 
> 
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20210126/b0baf9e4/attachment.htm>