3

I have set my auditd rules to log when the system time is changed

However, our servers are VMs and thus have problems with the time drifting out. We needed to solve this issue so we used a VMware tool to regularly synchronize the time.

My problem now is that my audit logs are overwhelmed with time change entries like this:

Jun  1 15:08:39 ***** audispd: node=****** type=SYSCALL
msg=audit(1338559719.053:344291):
arch=c000003e syscall=159 success=yes exit=5 a0=7ffff2084050 a1=0 a2=144b
a3=485449575f4c4c55 items=0 ppid=1 pid=1348 auid=4294967295 uid=0 gid=0 
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 
comm="vmtoolsd" exe="/usr/lib/vmware-tools/bin64/appLoader" key="time_change"

How can I exclude this vmware tool from the audit, but still capture a user changing the time?

Here are my current audit rules to capture time changes:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -k time_change
-a always,exit -F arch=b32 -S clock_settime -k time_change

1 Answer 1

1

If I've understood correctly, you're monitoring the kernel time change events. I see no direct method to prevent a single tool from appearing in the logs but I have two possible workarounds:

  1. Simply filter the log before reviewing the audit log. Perl or awk are your friends, or
  2. Use a custom script (e.g. in /etc/cron.d/) which turns the time audit off, updates the time, and then again turns the time audit on.

Unless your logs are too big for the storage device you're using, I'd prefer option 1 because that keeps full audit log and you're simply removing the parts you're not interested in by the time you're reviewing the audit log. Those automatic time changes are part of the reality and may be needed to interpret timestamps in the audit log in case of severe time drift near an occurrence of interesting audit event (hopefully your time adjustment software logs the adjusted amount of time so you can then later manually resync the time in the logs, if needed).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .