Hi,
I'm using CentOS, kernel 2.6.18-8.el5. I've compiled audit-1.5.6-1 and I'm
getting USER_AUTH events (logins, su, etc...) but I'm not seeing any syscall events.
My test audit.rules works fine in RHEL4, Suse10 and Fedora, but doesn't seem to
generate any syscall events in CentOS 5. For testing purposes, I'm using the
following in audit.rules:
# Log execute failures
-a exit,always -S execve -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F
exit!=-6
# Log administrative functions
-a exit,always -S reboot -S clock_settime -S settimeofday -S adjtimex -S
setdomainname -S sethostname -S reboot -S mount -S umount2
-a exit,always -S swapon -S swapoff -S create_module -S delete_module -S
quotactl -F success!=1
# Log Read/Write functions
-a exit,always -S open -S creat -S link -S symlink -S truncate -S ftruncate -S
mknod -S rename -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6
# Log file removal failures
-a exit,always -S unlink -S rmdir -F success!=1 -F exit!=-2 -F exit!=-20 -F
exit!=-17 -F exit!=-6
# Log file modification failures
-a exit,always -S chmod -S chown -S lchown -S fchmod -S fchown -F success!=1 -F
exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6
# Add watches for reboot stuff...
-w /sbin/init -p x -k runlevel
-w /sbin/telinit -p x -k runlevel
-w /sbin/halt -p x -k runlevel
-w /sbin/poweroff -p x -k runlevel
-w /sbin/reboot -p x -k runlevel
-w /sbin/shutdown -p x -k runlevel
Any ideas?
Bob
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
