We have configured auditd to log all access to certain critical files. The system runs WebLogic Server and we want to know if anyone is trying to poke around sensitive system files, such as the domain configuration file, encryption salt, et cetera. In some cases on some systems in the past, this worked as expected, but recently it has not, and I am at my wits' end trying to figure out why. So I am going against my nature and seeking outside assistance with this issue.
Relevant data points and possible leads I have been investigating:
- We recently picked up an updated system image with a new kernel version.
- The system image is OEL5 (essentialy RHEL5/CentOS 5)
- When I reboot the system, it only loads a minimal ruleset:
# auditctl -l LIST_RULES: exit,always dir=/etc/audit (0xa) perm=wa key=auditsys LIST_RULES: exit,always dir=/var/log/audit (0xe) perm=wa key=auditsys
Despite the full rules file still being in place.
When I try to restart the audit daemon (service auditd restart), I get the following error message:
Error sending add rule data request (No such file or directory) There was an error in line 30 of /etc/audit/audit.rules
which turns out to be because one of the files we have told it to watch does not exist yet. I resolve this by creating the file manually, and repeat for every subsequent error. It seems to me therefore that one cannot have the audit daemon watch a path pre-emptively and report initial creation of a given file.
Can anyone suggest a workaround or alternative solution to this issue?