After setting auditctl's rules, I want to send those matched records to my Python script for further analysis.

These are the involved files:

  • auditd records:

    type=PATH msg=audit(1451011319.268:533): ...
    type=CWD msg=audit(1451011319.268:533):  cwd=”/home/root”
    type=SYSCALL msg=audit(1451011319.268.230:533): ... key=(null)
  • /etc/audisp/audispd.conf is, as follows,

    q_depth = 80
    overflow_action = ignore
    priority_boost = 4
    max_restarts = 10
    name_format = HOSTNAME
    #name = mydomain
  • The audispd plugin configuration file in /etc/audisp/plugin.d/,

    active = yes
    direction = out
    path = /usr/bin/python
    type = always
    # two args, one is my Python script, the other is the log file
    args = /var/t/h.py /var/log/audit.log
    format = string
  • My h.py is, as follows,

    # -*- coding: utf-8 -*-
    import sys
    print sys.argv[1]

However, my Python script can't get any records from auditd.

I don't know where is wrong, please give me a hand!

1 Answer 1


It seems that audispd is writing audit events into its plugins stdin.

(Links to the source below are relative from https://github.com/packetstash/auditd/tree/ba912fa614a7e73160a4eba338e55890d6e8f62f. That's my first post on Server Fault, and I can't include more than two links).

In particular:

  • it creates a pair of sockets at audisp/audispd.c#L484;
  • then forks, sets child's stdin to one end of socket pair: audisp/audispd.c#L500;
  • and the writes events into another end: audisp/audispd.c#L533.

Your script will inherit open file descriptors from audispd, including stdout (fd #1), which would be reopened to /dev/null. So print in the script would likely have no effect, you'll have to write to some file.

Try something like:

import sys

with open('/tmp/my_audit.log', 'w') as log_file:
  for event_message in sys.stdin:
    log_file.write('%s\n' % event_message)

You may also want to use bindings/python/auparse_python.c module to parse the event messages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.