1

I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about audit messages being malformed. Removing the auditd package solves this problem.

I would also like to use AppArmor, which also generates a significant number of events for the kernel auditing system.

I constantly see messages like: audit: audit_lost=21473 audit_rate_limit=0 audit_backlog_limit=4096

When I had the audit package installed, I could use "auditctl -b XXX" to increase the audit backlog limit. But that tool was removed with the auditd package.

I've tried putting the "-b 8096" flag in the /etc/audit/rules.d/audit.rules file, but the backlog limit always stays fixed at 4096.

Is there some other setting in something like sysctl.conf that can be used to control the size of the audit backlog?

Thanks in advance.

3
  • 1
    You could always resort to editing the number 4096 in your OSQuery sources.. and complain to the developer or maintainer that it should not be overriding your (e.g. kernel command line) settings without warning.
    – anx
    Jul 27, 2019 at 4:00
  • anx... I don't think that OSQuery sets that limit. That limit is supposed to be defined in /etc/auditd/rules.d/audit.rules. With the -b flag. But when I put in values over 4096, it's ignored. I did find that I could copy the auditctl binary from a system with the audit package installed and it can run and change the setting. So, I can probably get away with doing it in an init script.
    – Craig M
    Jul 29, 2019 at 16:57
  • I suspect it does after searching for a relevant libaudit call.
    – anx
    Jul 29, 2019 at 17:15

0

You must log in to answer this question.

Browse other questions tagged .