Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to create a trigger in Zabbix to alert me anytime a type=AVC error appears in a CentOS 6 server's /var/log/audit/audit.log file.

I've already tried creating a basic log scrape. E.g.:

log[/var/log/audit/audit.log,type=AVC,"UTF-8",100]

However, it does not work. I believe this is due to the /var/log/audit/audit.log and it's parent folder using the following permissions:

drwxr-x---.  2 root root    4096 Apr 20 04:29 .
drwxr-xr-x. 13 root root    4096 Apr 14 12:07 ..
-rw-------.  1 root root 5948185 Apr 20 15:27 audit.log
-r--------.  1 root root 6291566 Apr 20 04:29 audit.log.1
-r--------.  1 root root 6291704 Apr 19 16:56 audit.log.2
-r--------.  1 root root 6291499 Apr 19 05:22 audit.log.3
-r--------.  1 root root 6291552 Apr 18 17:48 audit.log.4

I would prefer not to change the permissions for security reasons.

Has anyone done log monitoring of /var/log/audit/audit.log using Zabbix? And if so, how?

share|improve this question
    
Not used zabbix, but you can get AVCs emailed out to you by adding an email address to /var/lib/setroubleshoot/email_alert_recipients, this might help you by changing your MTA to execute a command on receipt of an email to a specified address. –  Matthew Ife Apr 21 '13 at 9:03
    
The folder /var/lib/setroubleshoot/ does not exist on my servers, am I supposed to create it? –  Soviero Apr 21 '13 at 16:24
    
Install the setroubleshoot-server package. –  Matthew Ife Apr 21 '13 at 16:26
    
Thanks, we'll see what I can do to connect the MTA to Zabbix... If it works I'll let you know. –  Soviero Apr 21 '13 at 16:39

3 Answers 3

up vote 1 down vote accepted

You can also create a new logfile, on each host, that gets copies of the relevant messages you want to trigger. Then you just create a job to copy actionable messages, from other logs to the new single log.

I try to stay away from mail, as that adds other issues and can prevent your security alert from getting out.

share|improve this answer
    
Interesting idea... –  Soviero Apr 26 '13 at 21:26

You can use zabbix for log file monitoring to watch the /var/log/audit/audit.log for the expected regexp (AVC possibly) and set a trigger accordingly.

share|improve this answer

It doesn't work, because you need to run zabbix agent as root, you must allow zabbix agent to access that file. After you can monitor file as usual.

Here is your template for SELinux: https://github.com/GioMac/zabbix/blob/master/templates/Template_SELinux.xml

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.