OS: CentOS 7
I am trying to figure out how audit (
kaudit) events are logged in
I have enabled
audit=1 in grub which means when the server boots, kernel auditing is enabled. This is the desired state for the particular system and disabling audit is out of the equation. My
audit configuration is as follows
# auditctl -s enabled 1 failure 1 pid 0 rate_limit 0 backlog_limit 64 lost 7452643 backlog 0 loginuid_immutable 0 unlocked
Auditd on the other side is disabled/stopped because I am using another tool to collect/consume those events generated by kernel audit.
My problem is that I noticed those audit events are logged in
2021-11-25T00:35:09.490607-08:00 myserver.local kernel: [4272426.343673] audit: type=1110 audit(1637829309.455:7426414): pid=2361 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success
I am trying to figure out how these messages end up in
/var/log/messages and the only thing I am sure is that syslog will do this.
Actually, I am trying to trace how the audit events end up in
rsyslog and so far I had no luck. I have an assumption that
journald is fetching those audit events which in turn forwards them to
rsyslog however, I am not able to clarify this.
Journald can establish a
netlink socket with the kernel to get audit events, however I don't see such socket present in systemd.
# systemctl list-units --type=socket UNIT LOAD ACTIVE SUB DESCRIPTION dbus.socket loaded active running D-Bus System Message Bus Socket dm-event.socket loaded active listening Device-mapper event daemon FIFOs iscsid.socket loaded active running Open-iSCSI iscsid Socket iscsiuio.socket loaded active listening Open-iSCSI iscsiuio Socket lvm2-lvmetad.socket loaded active listening LVM2 metadata daemon socket lvm2-lvmpolld.socket loaded active listening LVM2 poll daemon socket nscd.socket loaded active running Name Service Cache Daemon Socket rpcbind.socket loaded active running RPCbind Server Activation Socket systemd-initctl.socket loaded active listening /dev/initctl Compatibility Named Pipe systemd-journald.socket loaded active running Journal Socket systemd-shutdownd.socket loaded active listening Delayed Shutdown Socket systemd-udevd-control.socket loaded active running udev Control Socket systemd-udevd-kernel.socket loaded active running udev Kernel Socket # systemctl status systemd-journald-audit.socket Unit systemd-journald-audit.socket could not be found.
Now weird thing is that if I list
netlink sockets in the system, I can see one related to
# ss -a -f netlink|grep audit UNCONN 0 0 audit:systemd/1 * UNCONN 0 0 audit:sudo/3144 * UNCONN 0 0 audit:kernel * UNCONN 0 0 audit:sudo/14889 *
Any idea how these logs end up to syslog and what/how this
audit:systemd socket is created?
Most importantly , how to stop
journald gathering audit events?