Comments (8)
If you rebuild against master
and use this filter you won't see the 1305
messages anymore
filters:
- syscall: ""
message_type: 1305
regex: .*
from go-audit.
from go-audit.
root@ld4645:/home/bxj6191# export GOROOT=/home/bxj6191/go/
root@ld4645:/home/bxj6191# go version
go version go1.7 linux/amd64
from go-audit.
root@ld4645:/home/bxj6191# govendor -version
v1.0.8
from go-audit.
This is expected, basically go-audit
is ensuring that still holds the netlink socket to talk to kernel audit. This isn't a requirement on newer kernels but on Ubuntu 14.04 (kernel v3.13) there can be only one process talking to that netlink socket and there is no way of knowing that something took the connection away from go-audit
.
If you don't want to see them you can add a filter rule, this should work but I haven't tested it.
filters:
- syscall: 0
message_type: 1305
regex: .*
from go-audit.
added filter but still coming in. While we probably won't be using this version of ubuntu, it would be nice to see the filter actually work.
from go-audit.
thank you that fixed it.
from go-audit.
This doesn't work any more in the latest master in 2018.
audit.go line 299:
if af.syscall == "" {
return filters, fmt.Errorf("Filter %d is missing the syscall
entry", i+1)
}
How can I skip message_type 1305? My audit logs are overwhelmingly full of it.
from go-audit.
Related Issues (20)
- How to filter to command run in local0 to 7
- Reverse Function for Filters
- Including node hostname/ip info in log HOT 2
- Failed to open syslog writer on LXC HOT 1
- Pre-compiled version? HOT 3
- Replacing auditd with go-audit HOT 1
- wrong app name in syslogs HOT 1
- extras.go does not support disabled container auditing HOT 3
- LXD support
- Migrate away from govendor to go modules
- Migrate from "syscall" to "golang.org/x/sys/unix"
- Consider using code generation (ex: easyjson) for JSON models
- no tags/releases HOT 3
- go-audit relies on github.com/capsule8/capsule8, which was deleted or made private HOT 1
- "type":1305 AUDIT_CONFIG_CHANGE log noise HOT 2
- Do we need to implement logrotate for the go-audit.log file?
- Publish debian packages
- Process dies and go-audit stops logging HOT 2
- Enhance request for ECS compatible go-audit output
- When go-audit and linux auditd are started at the same time, go-audit cannot obtain any data. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from go-audit.