Re: No more report of quantity of rules successfully loaded
"warron.french" <[email protected]> Thu, 25 May 2023 20:41:20 -0400
| Newsgroups | com.redhat.linux-audit |
|---|---|
| Message-ID | <CAJdJdQk4-CL7fj3US+LkAR1_p9OJmbfUwYM687gkjF5c3RZV1g@mail.gmail.com> |
--===============6864479355722661586== Content-Type: multipart/alternative; boundary="0000000000009558fb05fc8dffa2" --0000000000009558fb05fc8dffa2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Obviously both of you are correct. I am thinking about the number of rules that load when not all of the rules load. Specifically, it gives a line number of the last line that loaded from the rules. Which, for troubleshooting purposes, I always put into a single file and sort "alphabetically." Also, I solved my own problem on the ruleset in the single file I was working with on my VM. I had 220 lines of syntax, and many of the lines were auditd controls, because I do not know the exact term to label them; things like -D -b -e -f and so on. Thank you both, sorry for the disruption. -------------------------- Warron French On Wed, May 24, 2023 at 4:01=E2=80=AFPM Richard Guy Briggs <[email protected]>= wrote: > On 2023-05-24 10:42, Steve Grubb wrote: > > Hello Warron, > > > > On Tuesday, May 23, 2023 7:12:07 PM EDT warron.french wrote: > > > Hi, I am running auditd-3.0.7-4 on an Alma Linux v8.8. > > > > > > I know that for all of RHEL 6 and RHEL 7 variants that I worked with, > to > > > include CentOS (not Stream) that after I rebooted a server or > restarted the > > > auditd service (with -e 1 set) that I would 100% of the time get a > report > > > in /var/log/messages about the quantity of rules that successfully > loaded. > > > > It has never done that unless someone else has a patch they did not sen= d > > upstream. > > > > > I could compare that to my unified rules file > > > (/etc/audit/rules.d/Unified.rules - for a reference) and strip out th= e > > > typical for auditd Control rules (-D, -e 1, -f 1, -b, -r, for > examples) and > > > then assess if I had the full set of files loaded or not. > > > > > > With this implementation of auditd, on version 3.0.7-4, I am not > getting > > > those results anymore. > > > Am I looking in the wrong place, because for me this is important > > > information? > > > > It has never done that. auditctl -D gives the output of auditctl -s as = a > > convenience. But auditctl -s has never reported how many rules are > loaded. I > > don't think the kernel has a counter. It has a variable for if any rule= s > are > > loaded, but not the quantity. > > Minor correction: there is a kernel variable (audit_n_rules) that counts > the number of syscall rules in place, but it isn't reported directly > outside the kernel. This feeds the boolean (struct > audit_context)->dummy. > > > > Yes, I know that I can also manually execute "auditctl -l | wc -l" > and get > > > that information too, but I was wondering if this is planned or if I > am > > > looking in the wrong place, or what to do. > > > > It has never done that and is not planned. > > > > -Steve > > - RGB > > -- > Richard Guy Briggs <[email protected]> > Sr. S/W Engineer, Kernel Security, Base Operating Systems > Remote, Ottawa, Red Hat Canada > IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 > -- > Linux-audit mailing list > [email protected] > https://listman.redhat.com/mailman/listinfo/linux-audit > > --0000000000009558fb05fc8dffa2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Obviously both of you are correct.=C2=A0 I am thinking abo= ut the number of rules that load when not all of the rules load.=C2=A0 Spec= ifically, it gives a line number of the last line that loaded from the rule= s.=C2=A0 Which, for troubleshooting purposes, I always put into a single fi= le and sort "alphabetically."<div><br></div><div>Also, I solved m= y own problem on the ruleset in the single file I was working with on my VM= .=C2=A0 I had 220 lines of syntax, and many of the lines were auditd contro= ls, because I do not know the exact term to label them; things like -D -b -= e -f and so on.</div><div><br></div><div>Thank you both, sorry for the disr= uption.<br clear=3D"all"><div><div dir=3D"ltr" class=3D"gmail_signature" da= ta-smartmail=3D"gmail_signature"><div dir=3D"ltr">-------------------------= -<br><font color=3D"#000099" size=3D"4">Warron French<br><font size=3D"4"><= font size=3D"4"><font size=3D"4"><br></font></font></font></font></div></di= v></div><br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" cla= ss=3D"gmail_attr">On Wed, May 24, 2023 at 4:01=E2=80=AFPM Richard Guy Brigg= s <<a href=3D"mailto:[email protected]">[email protected]</a>> wrote:<br></= div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor= der-left:1px solid rgb(204,204,204);padding-left:1ex">On 2023-05-24 10:42, = Steve Grubb wrote:<br> > Hello Warron,<br> > <br> > On Tuesday, May 23, 2023 7:12:07 PM EDT warron.french wrote:<br> > > Hi, I am running auditd-3.0.7-4 on an Alma Linux v8.8.<br> > > <br> > > I know that for all of RHEL 6 and RHEL 7 variants that I worked w= ith, to<br> > > include CentOS (not Stream) that after I rebooted a server or res= tarted the<br> > > auditd service (with -e 1 set) that I would 100% of the time get = a report<br> > > in /var/log/messages about the quantity of rules that successfull= y loaded.<br> > <br> > It has never done that unless someone else has a patch they did not se= nd <br> > upstream.<br> > <br> > > I could compare that to my unified rules file<br> > > (/etc/audit/rules.d/Unified.rules - for a reference) and strip ou= t the<br> > > typical for auditd Control rules (-D, -e 1, -f 1, -b, -r, for exa= mples) and<br> > > then assess if I had the full set of files loaded or not.<br> > > <br> > > With this implementation of auditd, on version 3.0.7-4, I am not = getting<br> > > those results anymore.<br> > > Am I looking in the wrong place, because for me this is important= <br> > > information?<br> > <br> > It has never done that. auditctl -D gives the output of auditctl -s as= a <br> > convenience. But auditctl -s has never reported how many rules are loa= ded. I <br> > don't think the kernel has a counter. It has a variable for if any= rules are <br> > loaded, but not the quantity.<br> <br> Minor correction: there is a kernel variable (audit_n_rules) that counts<br= > the number of syscall rules in place, but it isn't reported directly<br= > outside the kernel.=C2=A0 This feeds the boolean (struct<br> audit_context)->dummy.<br> <br> > > Yes, I know that I can also manually execute "auditctl -l=C2= =A0 | wc -l" and get<br> > > that information=C2=A0 too, but I was wondering if this is planne= d or if I am<br> > > looking in the wrong place, or what to do.<br> > <br> > It has never done that and is not planned.<br> > <br> > -Steve<br> <br> - RGB<br> <br> --<br> Richard Guy Briggs <<a href=3D"mailto:[email protected]" target=3D"_blank">= [email protected]</a>><br> Sr. S/W Engineer, Kernel Security, Base Operating Systems<br> Remote, Ottawa, Red Hat Canada<br> IRC: rgb, SunRaycer<br> Voice: +1.647.777.2635, Internal: (81) 32635<br> --<br> Linux-audit mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">Linux-audit@red= hat.com</a><br> <a href=3D"https://listman.redhat.com/mailman/listinfo/linux-audit" rel=3D"= noreferrer" target=3D"_blank">https://listman.redhat.com/mailman/listinfo/l= inux-audit</a><br> <br> </blockquote></div> --0000000000009558fb05fc8dffa2-- --===============6864479355722661586== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit --===============6864479355722661586==--