Bug #5913
openaudit_syslog does not correctly parse exec events and spams the log file as a result.
0%
Description
The audit_syslog(5) plugin does not parse all events correctly. This results in not logging the event if configured to do so and spams the log for each failed parse.
Example log message:
2015-05-07T13:33:00+00:00 standard1-dev root: [ID 702911 daemon.alert] The audit daemon has experienced the following problem with loading or executing plugins: /usr/lib/security/audit_syslog.so: load_error Unable to parse audit record This message has been displayed 2443 times.
Compiling the module with DEBUG set, the code creates a file /var/audit/dump with some extra information, a snippet of which is below:
syslog: parse failed for buffer 154073
syslog tossed (event=23) buffer 154074
syslog: parse failed for buffer 154074
syslog tossed (event=23) buffer 154075
syslog: parse failed for buffer 154075
syslog tossed (event=23) buffer 154076
syslog: parse failed for buffer 154076
syslog tossed (event=23) buffer 154077
syslog: parse failed for buffer 154077
Event 23 is "23:AUE_EXECVE:execve(2)". Not all events are affected I have seen events for cron correctly parsed and appear in syslog's log files.
No data to display