我们已经configuration了auditd来logging对某些重要文件的所有访问。 系统运行WebLogic Server，我们想要知道是否有人试图围绕敏感的系统文件，比如域configuration文件，encryption盐等等。 在过去的某些系统中，有些系统是按照预期工作的，但是最近还没有，而且我正在试图弄清楚为什么。 所以我违背自然，在这个问题上寻求外界的帮助。
我一直在调查的相关数据点和可能的线索：
＃auditctl -l
LIST_RULES：退出，总是dir = / etc / audit（0xa）perm = wa key = auditsys
LIST_RULES：退出，总是dir = / var / log / audit（0xe）perm = wa key = auditsys
尽pipe完整的规则文件仍然存在。
当我尝试重新启动审计守护进程（service auditd restart）时，出现以下错误消息：
Error sending add rule data request (No such file or directory) There was an error in line 30 of /etc/audit/audit.rules 原来是因为我们告诉它看的一个文件还不存在。 我通过手动创build文件解决这个问题，并重复每一个后续的错误。 因此在我看来，不能让审计守护进程预先观察path并报告给定文件的初始创build。
任何人都可以提出解决这个问题的解决方法或替代scheme？
这里有两个想法：
1）考虑在规则文件中使用-i。
“从文件读取规则时忽略错误，这将导致auditctl始终返回成功退出代码。
这不断parsing错误，并拿起其他规则。 否则，最终只会出现错误之前的规则。 显然这里有不利的一面，但是有时候最好有正确的规则。
2）一个简单的黑客来解决启动时不在的目录/文件是在系统达到运行状态时重新启动/重新加载auditd。
从审计邮件列表中传入
> On Mon, 2015-05-11 at 15:52 -0400, Steve Grubb wrote: > > On Monday, May 11, 2015 11:50:19 AM Bill Jackson III wrote: > > > Any pointers for troubleshooting auditd missing events for file reads, > > > edits, etc. ( -w _path_ -p raw) on OEL5/RHEL 5/CentOS 5? > > > > > > http://security.stackexchange.com/q/89009/56827 > > > > The -w notation is the same as > > > > -a always,exit -F path=XXX -F perms=rwa > > > > What this does is audit the following functions defined in the syscall > > classifiers > > : > > http://lxr.free-electrons.com/source/include/asm-generic/audit_read.h > > http://lxr.free-electrons.com/source/include/asm-generic/audit_write.h > > http://lxr.free-electrons.com/source/include/asm-generic/audit_change_attr.h > > > > You are not going to get a hit for each and every read system call because > > read is not audited. > > Bill, > > Is your question > > "Can one apply a file watch using auditd if the file does not exist?" > > then I believe the answer is no. There is a patch set coming to be able to address this case if the directory exists. Down the road, I'm hoping to be able to accomodate non-existant directories too. > Options would be > - as part of your application deployment standard operating procedures > (SOPs) add appropriate watches to audit.rules and restart the auditd > service > - keep all you sensitive files in one directory location, set a > directory watch on this directory tree and then as part of your > application deployment SOPs, place the real files in the sensitive file > area and then link to them from the application area. (I've just tried > this on a fc22 system and it works) > > Regards - RGB -- Richard Guy Briggs <[email protected]> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545