Otdfbt

Last survivors from different time periods living together

How bad would a partial hash leak be, realistically?

Version 2 - print new even-length arrays from two arrays

Avoiding cliches when writing gods

Do the English have an ancient (obsolete) verb for the action of the book opening?

Movie about a boy who was born old and grew young

Can an Eldritch Knight use Action Surge and thus Arcane Charge even when surprised?

How many pairs of subsets can be formed?

How would a aircraft visually signal in distress?

Quickest way to find characteristic polynomial from a given matrix

When writing an error prompt, should we end the sentence with a exclamation mark or a dot?

Company did not petition for visa in a timely manner. Is asking me to work from overseas, but wants me to take a paycut

Did the first version of Linux developed by Linus Torvalds have a GUI?

Building a road to escape Earth's gravity by making a pyramid on Antartica

2.8 is missing the Carve option in the Boolean Modifier

Does the "6 seconds per round" rule apply to speaking/roleplaying during combat situations?

How Can I Tell The Difference Between Unmarked Sugar and Stevia?

Why does Kathryn say this in 12 Monkeys?

Basic question about swap/swap spreads

Notation of last measure of a song with a pickup measure

Average spam confidence

Select items in a list that contain criteria #2

Should I "tell" my exposition or give it through dialogue?

How did students remember what to practise between lessons without any sheet music?

Sending auditd records to my audispd plugin

Auditd multi-line log formatauditd: Difference between watch and syscallauditd - Getting only EXECVE in ausearch?auditd doesn't log chmod at allWhat's stopping auditd from logging writes by Syslog when watching a Syslog file?Using auditd and retaining log files for 6 months.Auditd - log all ssh sessionsAuditd how to exclude everythingAuditd Log all executions except some scripts

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

2

1

After setting auditctl's rules, I want to send those matched records to my Python script for further analysis.

These are the involved files:

• 
  

  auditd records:

  
  
  

  type=PATH msg=audit(1451011319.268:533): ...
  type=CWD msg=audit(1451011319.268:533): cwd=”/home/root”
  type=SYSCALL msg=audit(1451011319.268.230:533): ... key=(null)
  

  
  


• 
  

  /etc/audisp/audispd.conf is, as follows,

  
  
  

  q_depth = 80
  overflow_action = ignore
  priority_boost = 4
  max_restarts = 10
  name_format = HOSTNAME
  #name = mydomain
  

  
  


• 
  

  The audispd plugin configuration file in /etc/audisp/plugin.d/,

  
  
  

  active = yes
  direction = out
  path = /usr/bin/python
  type = always
  # two args, one is my Python script, the other is the log file
  args = /var/t/h.py /var/log/audit.log
  format = string
  

  
  


• 
  

  My h.py is, as follows,

  
  
  

  # -*- coding: utf-8 -*-
  
  import sys
  
  print sys.argv[1]
  ...
  

  
  

However, my Python script can't get any records from auditd.

I don't know where is wrong, please give me a hand!

linux audit auditd

share|improve this question

edited Aug 17 '16 at 13:47

Mateusz Piotrowski

1479

asked Dec 26 '15 at 14:35

Matt ElsonMatt Elson

1163

add a comment | 

2

1

After setting auditctl's rules, I want to send those matched records to my Python script for further analysis.

These are the involved files:

• 
  

  auditd records:

  
  
  

  type=PATH msg=audit(1451011319.268:533): ...
  type=CWD msg=audit(1451011319.268:533): cwd=”/home/root”
  type=SYSCALL msg=audit(1451011319.268.230:533): ... key=(null)
  

  
  


• 
  

  /etc/audisp/audispd.conf is, as follows,

  
  
  

  q_depth = 80
  overflow_action = ignore
  priority_boost = 4
  max_restarts = 10
  name_format = HOSTNAME
  #name = mydomain
  

  
  


• 
  

  The audispd plugin configuration file in /etc/audisp/plugin.d/,

  
  
  

  active = yes
  direction = out
  path = /usr/bin/python
  type = always
  # two args, one is my Python script, the other is the log file
  args = /var/t/h.py /var/log/audit.log
  format = string
  

  
  


• 
  

  My h.py is, as follows,

  
  
  

  # -*- coding: utf-8 -*-
  
  import sys
  
  print sys.argv[1]
  ...
  

  
  

However, my Python script can't get any records from auditd.

I don't know where is wrong, please give me a hand!

linux audit auditd

share|improve this question

edited Aug 17 '16 at 13:47

Mateusz Piotrowski

1479

asked Dec 26 '15 at 14:35

Matt ElsonMatt Elson

1163

add a comment | 

After setting auditctl's rules, I want to send those matched records to my Python script for further analysis.

These are the involved files:

• 
  

  auditd records:

  
  
  

  type=PATH msg=audit(1451011319.268:533): ...
  type=CWD msg=audit(1451011319.268:533): cwd=”/home/root”
  type=SYSCALL msg=audit(1451011319.268.230:533): ... key=(null)
  

  
  


• 
  

  /etc/audisp/audispd.conf is, as follows,

  
  
  

  q_depth = 80
  overflow_action = ignore
  priority_boost = 4
  max_restarts = 10
  name_format = HOSTNAME
  #name = mydomain
  

  
  


• 
  

  The audispd plugin configuration file in /etc/audisp/plugin.d/,

  
  
  

  active = yes
  direction = out
  path = /usr/bin/python
  type = always
  # two args, one is my Python script, the other is the log file
  args = /var/t/h.py /var/log/audit.log
  format = string
  

  
  


• 
  

  My h.py is, as follows,

  
  
  

  # -*- coding: utf-8 -*-
  
  import sys
  
  print sys.argv[1]
  ...
  

  
  

However, my Python script can't get any records from auditd.

I don't know where is wrong, please give me a hand!

linux audit auditd

share|improve this question

edited Aug 17 '16 at 13:47

Mateusz Piotrowski

1479

asked Dec 26 '15 at 14:35

Matt ElsonMatt Elson

1163

share|improve this question

edited Aug 17 '16 at 13:47

Mateusz Piotrowski

1479

asked Dec 26 '15 at 14:35

Matt ElsonMatt Elson

1163

share|improve this question

edited Aug 17 '16 at 13:47

Mateusz Piotrowski

1479

asked Dec 26 '15 at 14:35

Matt ElsonMatt Elson

1163

edited Aug 17 '16 at 13:47

Mateusz Piotrowski

1479

edited Aug 17 '16 at 13:47

Mateusz Piotrowski

1479

asked Dec 26 '15 at 14:35

Matt ElsonMatt Elson

1163

asked Dec 26 '15 at 14:35

Matt ElsonMatt Elson

1163

1 Answer
1

active

oldest

votes

0

It seems that audispd is writing audit events into its plugins stdin.

(Links to the source below are relative from https://github.com/packetstash/auditd/tree/ba912fa614a7e73160a4eba338e55890d6e8f62f. That's my first post on Server Fault, and I can't include more than two links).

In particular:

• it creates a pair of sockets at audisp/audispd.c#L484;


• then forks, sets child's stdin to one end of socket pair: audisp/audispd.c#L500;


• and the writes events into another end: audisp/audispd.c#L533.

Your script will inherit open file descriptors from audispd, including stdout (fd #1), which would be reopened to /dev/null. So print in the script would likely have no effect, you'll have to write to some file.

Try something like:

import sys

with open('/tmp/my_audit.log', 'w') as log_file:
 for event_message in sys.stdin:
 log_file.write('%sn' % event_message)

You may also want to use bindings/python/auparse_python.c module to parse the event messages.

share|improve this answer

answered Mar 10 '17 at 6:45

Kirill SpitsynKirill Spitsyn

101

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f745336%2fsending-auditd-records-to-my-audispd-plugin%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

It seems that audispd is writing audit events into its plugins stdin.

(Links to the source below are relative from https://github.com/packetstash/auditd/tree/ba912fa614a7e73160a4eba338e55890d6e8f62f. That's my first post on Server Fault, and I can't include more than two links).

In particular:

• it creates a pair of sockets at audisp/audispd.c#L484;


• then forks, sets child's stdin to one end of socket pair: audisp/audispd.c#L500;


• and the writes events into another end: audisp/audispd.c#L533.

Your script will inherit open file descriptors from audispd, including stdout (fd #1), which would be reopened to /dev/null. So print in the script would likely have no effect, you'll have to write to some file.

Try something like:

import sys

with open('/tmp/my_audit.log', 'w') as log_file:
 for event_message in sys.stdin:
 log_file.write('%sn' % event_message)

You may also want to use bindings/python/auparse_python.c module to parse the event messages.

share|improve this answer

answered Mar 10 '17 at 6:45

Kirill SpitsynKirill Spitsyn

101

add a comment | 

0

It seems that audispd is writing audit events into its plugins stdin.

(Links to the source below are relative from https://github.com/packetstash/auditd/tree/ba912fa614a7e73160a4eba338e55890d6e8f62f. That's my first post on Server Fault, and I can't include more than two links).

In particular:

• it creates a pair of sockets at audisp/audispd.c#L484;


• then forks, sets child's stdin to one end of socket pair: audisp/audispd.c#L500;


• and the writes events into another end: audisp/audispd.c#L533.

Your script will inherit open file descriptors from audispd, including stdout (fd #1), which would be reopened to /dev/null. So print in the script would likely have no effect, you'll have to write to some file.

Try something like:

import sys

with open('/tmp/my_audit.log', 'w') as log_file:
 for event_message in sys.stdin:
 log_file.write('%sn' % event_message)

You may also want to use bindings/python/auparse_python.c module to parse the event messages.

share|improve this answer

answered Mar 10 '17 at 6:45

Kirill SpitsynKirill Spitsyn

101

add a comment | 

It seems that audispd is writing audit events into its plugins stdin.

(Links to the source below are relative from https://github.com/packetstash/auditd/tree/ba912fa614a7e73160a4eba338e55890d6e8f62f. That's my first post on Server Fault, and I can't include more than two links).

In particular:

• it creates a pair of sockets at audisp/audispd.c#L484;


• then forks, sets child's stdin to one end of socket pair: audisp/audispd.c#L500;


• and the writes events into another end: audisp/audispd.c#L533.

Your script will inherit open file descriptors from audispd, including stdout (fd #1), which would be reopened to /dev/null. So print in the script would likely have no effect, you'll have to write to some file.

Try something like:

import sys

with open('/tmp/my_audit.log', 'w') as log_file:
 for event_message in sys.stdin:
 log_file.write('%sn' % event_message)

You may also want to use bindings/python/auparse_python.c module to parse the event messages.

share|improve this answer

answered Mar 10 '17 at 6:45

Kirill SpitsynKirill Spitsyn

101

import sys

with open('/tmp/my_audit.log', 'w') as log_file:
 for event_message in sys.stdin:
 log_file.write('%sn' % event_message)

share|improve this answer

answered Mar 10 '17 at 6:45

Kirill SpitsynKirill Spitsyn

101

answered Mar 10 '17 at 6:45

Kirill SpitsynKirill Spitsyn

101

answered Mar 10 '17 at 6:45

Kirill SpitsynKirill Spitsyn

101