8:auditd.conf

From Linux Man Pages

Jump to: navigation, search
      auditd.conf - audit daemon configuration file
      

Contents

DESCRIPTION

      The file /etc/auditd.conf contains configuration information specific to the audit daemon.  It should contain one
      configuration keyword per line, an equal sign, and then followed by appropriate configuration  information.   The
      keywords  recognized  are:  log_file,  log_format,  flush,  freq,  num_logs,  max_log_file,  max_log_file_action,
      space_left, action_mail_acct, space_left_action, admin_space_left, admin_space_left_action, disk_full_action, and
      disk_error_action.  These keywords are described below.
 
      log_file
             This keyword specifies the full path name to the log file where audit records will be stored. It must be a
             regular file.
 
      log_format
             The log format describes how the information should be stored on disk. There are 2 options: raw and nolog.
             If  set  to  RAW  ,  the  audit records will be stored in a format exactly as the kernel sends it. If this
             option is set to NOLOG then all audit information is discarded instead of writing to disk. This mode  does
             not affect data sent to the audit event dispatcher.
 
      priority_boost
             This  is a non-negative number that tells the audit damon how much of a priority boost it should take. The
             default is 3. No change is 0.
 
      flush  Valid values are none, incremental, data,  and sync.  If set to none, no special effort is made  to  flush
             the  audit  records to disk. If set to incremental, Then the freq parameter is used to determine how often
             an explicit flush to disk is issued.  The data parameter tells the audit damon to keep the data portion of
             the  disk file sync'd at all times. The sync option tells the audit daemon to keep both the data and meta-
             data fully sync'd with every write to disk.
 
      freq   This is a non-negative number that tells the audit damon how many  records  to  write  before  issuing  an
             explicit flush to disk command. this value is only valid when the flush keyword is set to incremental.
 
      num_logs
             This  keyword specifies the number of log files to keep if rotate is given as the max_log_file_action.  If
             the number is < 2, logs are not rotated. This number must be 99 or less.  The default is 0 -  which  means
             no  rotation.  As  you  increase  the number of log files being rotated, you may need to adjust the kernel
             backlog setting upwards since it takes  more  time  to  rotate  the  files.  This  is  typically  done  in
             /etc/audit.rules.
 
      dispatcher
             The  dispatcher is a program that is started by the audit daemon when it starts up. It will pass a copy of
             all audit events to that application's stdin. Make sure you trust the application that  you  add  to  this
             line since it runs with root privileges.
 
      disp_qos
             This  option  controls  whether you want blocking/lossless or non-blocking/lossy communication between the
             audit daemon and the dispatcher. There is a 128k buffer between the audit daemon and dispatcher.  This  is
             good  enogh  for most uses. If lossy is chosen, incoming events going to the dispatcher are discarded when
             this queue is full. (Events are still written to disk if log_format is not nolog.)  Otherwise  the  auditd
             daemon  will  wait  for the queue to have an empty spot before logging to disk. The risk is that while the
             daemon is waiting for network IO, an event is not being recorded to disk.  Valid  values  are:  lossy  and
             lossless. Lossy is the default value.
 
      max_log_file
             This  keyword  specifies the maximum file size in megabytes. When this limit is reached, it will trigger a
             configurable action. The value given must be numeric.
 
      max_log_file_action
             This parameter tells the system what action to take when the system has detected that the  max  file  size
             limit has been reached. Valid values are ignore, syslog, suspend, rotate and keep_logs.  If set to ignore,
             the audit daemon does nothing.  syslog means that it will issue a warning to syslog.  suspend  will  cause
             the  audit  daemon  to stop writing records to the disk. The daemon will still be alive. The rotate option
             will cause the audit daemon to rotate the logs. It should be noted that logs with higher numbers are older
             than  logs  with  lower  numbers. This is the same convention used by the logrotate utility. The keep_logs
             option is similar to rotate except it does not use the num_logs setting. This  prevents  audit  logs  from
             being overwritten.
 
      action_mail_acct
             This  option  should  contain  a  valid  email address or alias. The default address is root. If the email
             address is not local to the machine, you must make sure you have email properly configured on your machine
             and network. Also, this option requires that /usr/lib/sendmail exists on the machine.
 
      space_left
             This  is  a  numeric  value in megabytes that tells the audit daemon when to perform a configurable action
             because the system is starting to run low on disk space.
 
      space_left_action
             This parameter tells the system what action to take when the system has detected that it  is  starting  to
             get  low  on  disk  space.   Valid values are ignore, syslog, email, suspend, single, and halt.  If set to
             ignore, the audit daemon does nothing.  syslog means that it will issue a warning to syslog.  Email  means
             that it will send a warning to the email account specified in action_mail_acct as well as sending the mes-
             sage to syslog.  suspend will cause the audit daemon to stop writing records to the disk. The daemon  will
             still  be  alive.  The single option will cause the audit daemon to put the computer system in single user
             mode.  halt option will cause the audit daemon to shutdown the computer system.
 
      admin_space_left
             This is a numeric value in megabytes that tells the audit daemon when to  perform  a  configurable  action
             because the system is running low on disk space. This should be considered the last chance to do something
             before running out of disk space. The numeric value for this parameter should be lower than the number for
             space_left.
 
      admin_space_left_action
             This  parameter  tells  the system what action to take when the system has detected that it is low on disk
             space.  Valid values are ignore, syslog, email, suspend, single, and halt.  If set to  ignore,  the  audit
             daemon  does nothing.  Syslog means that it will issue a warning to syslog.  Email means that it will send
             a warning to the email account specified in action_mail_acct as well as sending  the  message  to  syslog.
             Suspend  will  cause the audit daemon to stop writing records to the disk. The daemon will still be alive.
             The single option will cause the audit daemon to put the computer system in single user mode.  halt
 
      disk_full_action
             This parameter tells the system what action to take when the system has detected  that  the  partition  to
             which  log  files are written has become full. Valid values are ignore, syslog, suspend, single, and halt.
             If set to ignore, the audit daemon does nothing.  Syslog means that it will issue  a  warning  to  syslog.
             Suspend  will  cause the audit daemon to stop writing records to the disk. The daemon will still be alive.
             The single option will cause the audit daemon to put the computer system in single user mode.  halt option
             will cause the audit daemon to shutdown the computer system.
 
      disk_error_action
             This parameter tells the system what action to take whenever there is an error detected when writing audit
             events to disk or rotating logs. Valid values are ignore, syslog, suspend, single, and halt.   If  set  to
             ignore, the audit daemon does nothing.  Syslog means that it will issue a warning to syslog.  Suspend will
             cause the audit daemon to stop writing records to the disk. The daemon will still  be  alive.  The  single
             option will cause the audit daemon to put the computer system in single user mode.  halt option will cause
             the audit daemon to shutdown the computer system.

NOTES

      In a CAPP environment, the audit trail is considered so important that access to system resources must be  denied
      if an audit trail cannot be created. In this environment, it would be suggested that /var/log/audit be on its own
      partition. This is to ensure that space detection is accurate and that no other process comes along and  consumes
      part of it.
 
      The flush parameter should be set to sync or data.
 
      Max_log_file  and num_logs need to be adjusted so that you get complete use of your partition. It should be noted
      that the more files that have to be rotated, the  longer  it  takes  to  get  back  to  receiving  audit  events.
      Max_log_file_action should be set to keep_logs.
 
      Space_left  should  be set to a number that gives the admin enough time to react to any alert message and perform
      some maintenance to free up disk space. This would typically involve running the aureport -t  report  and  moving
      the  oldest logs to an archive area. The value of space_left is site dependant since the rate at which events are
      generated varies with each deployment. The space_left_action is recommended to be set to email.
 
      Admin_space_left should be set to the amount of disk space on the audit partition needed for admin actions to  be
      recorded.  Admin_space_left_action  would  be  set to single so that use of the machine is restricted to just the
      console.
 
      The disk_full_action is triggered when no more room exists on the partition.  All  access  should  be  terminated
      since no more audit capability exists. This can be set to either single or halt.
 
      The  disk_error_action  should  be set to syslog, single, or halt depending on your local policies regarding han-
      dling of hardware malfunctions.

FILES

      /etc/auditd.conf
             Audit daemon configuration file

RELATED

      auditd(8)

CATEGORY

Personal tools