Sending auditd records to my audispd plugin

Question

After setting auditctl's rules, I want to send those matched records to my Python script for further analysis.

These are the involved files:

• auditd records:

  type=PATH msg=audit(1451011319.268:533): ...
  type=CWD msg=audit(1451011319.268:533):  cwd=”/home/root”
  type=SYSCALL msg=audit(1451011319.268.230:533): ... key=(null)
  

• /etc/audisp/audispd.conf is, as follows,

  q_depth = 80
  overflow_action = ignore
  priority_boost = 4
  max_restarts = 10
  name_format = HOSTNAME
  #name = mydomain
  

• The audispd plugin configuration file in /etc/audisp/plugin.d/,

  active = yes
  direction = out
  path = /usr/bin/python
  type = always
  # two args, one is my Python script, the other is the log file
  args = /var/t/h.py /var/log/audit.log
  format = string
  

• My h.py is, as follows,

  # -*- coding: utf-8 -*-
  
  import sys
  
  print sys.argv[1]
  ...
  

However, my Python script can't get any records from auditd.

I don't know where is wrong, please give me a hand!

Answer 1

It seems that audispd is writing audit events into its plugins stdin.

(Links to the source below are relative from https://github.com/packetstash/auditd/tree/ba912fa614a7e73160a4eba338e55890d6e8f62f. That's my first post on Server Fault, and I can't include more than two links).

In particular:

• it creates a pair of sockets at audisp/audispd.c#L484;
• then forks, sets child's stdin to one end of socket pair: audisp/audispd.c#L500;
• and the writes events into another end: audisp/audispd.c#L533.

Your script will inherit open file descriptors from audispd, including stdout (fd #1), which would be reopened to /dev/null. So print in the script would likely have no effect, you'll have to write to some file.

Try something like:

import sys

with open('/tmp/my_audit.log', 'w') as log_file:
  for event_message in sys.stdin:
    log_file.write('%s\n' % event_message)

You may also want to use bindings/python/auparse_python.c module to parse the event messages.