I submitted a patch to libvirt to add the qemu pid (vm-pid) to the
VIRT_CONTROL audit record.
I'm using this field to correlate anomaly events to guest in auvirt and
as a fallback it tries to use the SELinux context for that.
Regards,
Marcelo
On 01/25/2012 10:56 AM, Marcelo Cerri wrote:
I agree that pid and time is a better way for correlation but I was
coding a solution based on that when I figured out a problem. There's
no qemu pid in the audit logs. Libvirt (at least the libvirt shipped
with RHEL 6.2) always logs its own pid to the audit log.
I'll try to discover if there is another way to correlate them or if
newer versions of libvirt log the qemu pid to the audit log.
Regards,
Marcelo
On 01/24/2012 06:27 PM, Steve Grubb wrote:
On Tuesday, January 24, 2012 01:08:56 PM Marcelo Cerri wrote:
I took a look at some anomaly events and I'm thinking to correlate them
to guests based on the SELinux context or maybe based on the pid field.
Do you think there is another ways to correlate them?
I was thinking to correlate them based on the time and pid. If its
within the
time range between startup/shutdown and its the same pid, then you
have the
event correlated. If its outside the time range or a different pid,
then you do
not have correlation. I would not look at selinux label because not all
systems/distros have it enabled or compiled in. So, pid and time are
the most
universal identifiers for correlation.
-Steve
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
