linux - 如何从应用程序登录 AUDITD？

Question

我们正在考虑从 rsyslog 迁移到 auditd，但我还没有找到应用程序应该如何将日志消息输出到 auditd。 (使用 rsyslog 有详细记录)。

Answer 1

您将 auditd 理解为日志记录的替代品是不正确的。 Auditd 不能直接替代 syslog/rsyslog 类型的日志记录。相反，它会根据对内核的系统调用生成日志。

然后 man page解释一下:

auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities. Configuring the audit system or loading rules is done with the auditctl utility. During startup, the rules in /etc/audit/audit.rules are read by auditctl and loaded into the kernel. Alternately, there is also an augenrules program that reads rules located in /etc/audit/rules.d/ and compiles them into an audit.rules file. The audit daemon itself has some configuration options that the admin may wish to customize. They are found in the auditd.conf file.

还有一篇很好的 auditd 概述，标题为:A Brief Introduction to auditd :

.... Since it operates at the kernel level this gives us a hook into any system operation we want. We have the option to write a log any time a particular system call happens, whether that be unlink or getpid. We can monitor access to any file, all network traffic, really anything we want. The level of detail is pretty phenomenal and, since it operates at such a low level, the granularity of information is incredibly useful.

我还会指导您阅读本教程，标题为:How To Use the Linux Auditing System on CentOS 7 .您将从 auditd 获得的日志记录类型示例。

type=SYSCALL msg=audit(1434371271.277:135496): arch=c000003e syscall=2 success=yes exit=3 a0=7fff0054e929 a1=0 a2=1fffffffffff0000 a3=7fff0054c390 items=1 ppid=6265 pid=6266 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=113 comm="cat" exe="/usr/bin/cat" key="sshconfigchange"

type=CWD msg=audit(1434371271.277:135496):  cwd="/home/sammy"

type=PATH msg=audit(1434371271.277:135496): item=0 name="/etc/ssh/sshd_config" inode=392210 dev=fd:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL

这全部来自单个事件，但通过 auditd 记录了 3 条消息。您可以通过 msg=audit(...) 字段判断哪些事件关联。

我给你看这个例子，因为这种类型的日志记录是由内核驱动的，而不是应用程序本身。

注意:Auditd 的真正目的是生成与 Linux 内核交互的审计日志，而 syslog/rsyslog 实际上是为了从应用程序本身进行通用日志记录。