On Friday, September 7, 2018 7:30:09 AM EDT Osama Elnaggar wrote: > Hi, > > I'm working on a custom audispd plugin written in Python 3. It’s a work in > progress and I’ve successfully run it numerous times as an audispd plugin. > However, I sometimes make modifications that result in the audispd plugin > failing and I end up with the following in /var/log/syslog > > Sep 6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3 > terminated unexpectedly > Sep 6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3 was > restarted > ... > > This is repeated several times until audispd gives up and I see the > following message: > > Sep 6 20:52:14 ubuntu-hypervisor audispd: plugin /usr/bin/python3 has > exceeded max_restarts > > To troubleshoot, I modify my code to read from /var/log/audit/audit.log > instead. I modify a single line (with fileinput.input() to read from > myfile as shown in the commented line below). > > Here is the code snippet (a colorized easier to read version is available > here - https://pastebin.com/84Nxu3Rp): > > # let us initialize the AuParser > aup = auparse.AuParser(auparse.AUSOURCE_FEED) > > # we initalize the callback to be fn_process_event > aup.add_callback(fn_process_event, None, None) > > myfile = "/var/log/audit/audit.log" > > while True: > try: > # we read in line by line from stdin > for line in fileinput.input(): > #for line in fileinput.input(myfile): > aup.feed(line) > except: > logger.error("Fatal error in while loop", exc_info=True) > > # we flush the feed when we quit > aup.flush_feed() > > Any suggestions on how to troubleshoot these types of issues when reading > from a file works fine without issue but running it as a plugin fails as > shown in /var/log/syslog? Thanks.
All plugins have a requirement to take events from stdin. As long as it expects strings (which is the way that auparse wants them), then all you have to do is: ausearch --start boot --raw | ./plugin You can also save raw logs with ausearch and cat them into the plugin. This is helpful when you get a problem down to a certain series of events and you don't want to go through a thousand events before the problem sequence. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
