Auditd showing duplicate lines in audit.log

I'm having an issue where auditd seems to be logging the same message twice, see below for example:

type=EXECVE msg=audit(1495742109.857:90234552): argc=1 a0="/bin/bash" type=EXECVE msg=audit(1495742109.857:90234552): argc=1 a0="/bin/bash" 

and here is the relevant configuration:

log_file = /var/log/audit/audit.log log_format = RAW log_group = root priority_boost = 4 flush = incremental freq = 20 num_logs = 3 disp_qos = lossy dispatcher = /sbin/audispd name_format = none name = lga-tag06 max_log_file = 1024 max_log_file_action = rotate space_left = 75 space_left_action = syslog action_mail_acct = root admin_space_left = 50 admin_space_left_action = suspend disk_full_action = suspend disk_error_action = suspend tcp_listen_queue = 5  tcp_max_per_addr = 1 tcp_client_max_idle = 0 enable_krb5 = no krb5_principal = auditd 

and the relevant rules:

# Default Rule - Delete ALL -D enter code here # Set Buffer size - increase for Busy Systems -b 8192 enter code here # Puppet Managed Custom rules begin here: -b 320 -D -a exclude,never -F msgtype=PATH  -a exclude,never -F msgtype=BPRM_FCAPS  -a exclude,never -F msgtype=CRED_DISP -a exit,always -F arch=b32 -F euid>=0 -S execve -a exit,always -F arch=b64 -F euid>=0 -S execve 

Curious if anyone has seen this before or has any suggestions?

1 Answers

Answers 1

I can't say for sure, but until you add the information I requested on the comment to your question, I will go with the following:

Note / Update: This extends to the bounty. Although the comment regarding the extra lines doesn't apply, the remaining questions about distribution and versions do.

You might be hitting the bug reported in red hat's tracker and in systemd github, which state that there is an issue between auditd and systemd's journald.

The proposed solution there is to disable the audit support from the journal:

systemctl mask systemd-journald-audit.socket 

Before trying it, please read the linked issues above and take all the necessary considerations.

Read More

Syslog not forwarding remote messages

I configured /etc/syslog.conf with below configuration

*.* @10.10.10.2:514 *.* @@10.10.10.2:514 

and logged through below code

openlog("Test-Msg", LOG_PID, LOG_LOCAL0); for (int i = 0; i <10; i++) {     syslog(LOG_ALERT, "My msg %d", i);     std::cout<<"-------------Writing Syslog "<<i<<"\n"; }  closelog(); 

but its not forwarding to remote server. instead of that it creates a file "@10.10.10.2:514" & "@@10.10.10.2:514" and logging all the message there.

Tested with wireshark, no messages are forwarded to remote system.

I am using yocto platform and busybox 1.22 syslog implementation.

Update

In yocto I saw one more configuration file /etc/syslog-startup.conf and there I configured

DESTINATION=remote  # log destinations (buffer file remote) REMOTE=10.10.10.2:514          # where to log (syslog remote) 

Now its started forwarding all the messages, but as per the linux manuals syslog conf must support *.=alert @<host:port> filter. If I have to use the above configuration how can I apply the filters?

2 Answers

Answers 1

By default Yocto-based systems use Busybox to provide minimal versions of many basic tools. syslog is one of those tools. This is a quote from Busybox documentation:

Note that this version of syslogd ignores /etc/syslog.conf.

To get full syslog functionality you'd have to include a more complete implementation on your image. There are several options in meta-openembedded, rsyslog in meta-oe is probably a good default choice.

Answers 2

I would first use logger (tool incluided in busybox) to ensure that your syslog configuration is correct. If the messages are sent well by this method, then we can investigate the code.

logger [OPTIONS] [MESSAGE]  Write MESSAGE to the system log. If MESSAGE is omitted, log stdin.  Options:          -s      Log to stderr as well as the system log         -t TAG  Log using the specified tag (defaults to user name)         -p PRIO Priority (numeric or facility.level pair) 

Read More

Rsyslog to direct log messages to local syslog host on port 5000 using TCP

I have configured the below filter for rsyslog to direct a few SSH messages to a specific TCP port 5000 on the local system, so that the service running on the 5000 will process the SSH messages further.

if $fromhost-ip == '127.0.0.1' and ( ($msg contains 'SSH') and ($msg contains 'Test') ) then @@127.0.0.1:5000 

Everything seems fine, but the messages are not redirected to the port 5000 and if we direct the messages to UDP port it is working fine.

Below is the filter for messages directing to UDP port.

if $fromhost-ip == '127.0.0.1' and ( ($msg contains 'SSH') and ($msg contains 'Test') ) then @127.0.0.1:5000 

Could you please let me know, why TCP port do not work and UDP port works.

2 Answers

Answers 1

I think that you can use tunneling for this. For example

ssh username@serverAddress -L 5000:11.22.33.44:80      # username - username on server     # serverAddress - server address     # 8080: - port on the local machine that will be opened on loopback interface (127.0.0.1)     # 11.22.33.44 - IP address of the server that we'll create a tunnel to using SSH 

Look here for more info: https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-tunneling-on-a-vps

I hope this helps!

Answers 2

May be you decide to use RELP? (https://en.wikipedia.org/wiki/Reliable_Event_Logging_Protocol)

As described at https://linux.die.net/man/5/rsyslog.conf

you need to replace your "then @127.0.0.1:5000" to "then :omrelp:127.0.0.1:5000"

Read More

Send JSON from rsyslog to Kibana

I'm using rsyslog to watch over my syslogs and send them over to Logstash+Kibana.

My syslogs messages are logged as JSON. They can look something like this:

{"foo":"bar", "timegenerated": 43843274834} 

rsyslog configuration as so:

module(load="omelasticsearch")  #define a template to print all fields of the message template(name="messageToES" type="list" option.json="on") {   property(name="msg") } *.* action(type="omelasticsearch"        server="localserverhere"        serverport="80"        template="messageToES") 

The Kibana is fine, since if I run a CURL command to it, it receives the record. The code as below:

curl -XPOST myserver/test/bar -d '{"test": "baz", "timegenerated":1447145221519}' 

When I run rsyslogs and point it to a dummy server, I can see the incoming requests with the valid json. However, when I point it back to my logstash server, it doesn't show up in logstash or kibana.

Does anyone know how to send syslogs as json into Kibana/logstash?

1 Answers

Answers 1

I've never used it, but it looks like you are missing things from your config file. The docs have a pretty thorough example:

module(load="omelasticsearch") template(name="testTemplate"      type="list"      option.json="on") {        constant(value="{")          constant(value="\"timestamp\":\"")      property(name="timereported" dateFormat="rfc3339")          constant(value="\",\"message\":\"")     property(name="msg")          constant(value="\",\"host\":\"")        property(name="hostname")          constant(value="\",\"severity\":\"")    property(name="syslogseverity-text")          constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")          constant(value="\",\"syslogtag\":\"")   property(name="syslogtag")        constant(value="\"}")      } action(type="omelasticsearch"    server="myserver.local"    serverport="9200"    template="testTemplate"    searchIndex="test-index"    searchType="test-type"    bulkmode="on"    queue.type="linkedlist"    queue.size="5000"    queue.dequeuebatchsize="300"    action.resumeretrycount="-1") 

Based on what you are trying to do, it looks like you need to plug in localserverhere where it shows myserver.local. It also looks like you have ES accepting stuff on port 80, so you'd put in 80 instead of 9200.

Read More