go-audit on ubuntu sending an "event" every 5 seconds with no related audit rule about go-audit HOT 8 CLOSED

If you rebuild against master and use this filter you won't see the 1305 messages anymore

filters:
  - syscall: ""
    message_type: 1305
    regex: .*

from go-audit.

from go-audit.

root@ld4645:/home/bxj6191# export GOROOT=/home/bxj6191/go/
root@ld4645:/home/bxj6191# go version
go version go1.7 linux/amd64

from go-audit.

root@ld4645:/home/bxj6191# govendor -version
v1.0.8

from go-audit.

This is expected, basically go-audit is ensuring that still holds the netlink socket to talk to kernel audit. This isn't a requirement on newer kernels but on Ubuntu 14.04 (kernel v3.13) there can be only one process talking to that netlink socket and there is no way of knowing that something took the connection away from go-audit.

If you don't want to see them you can add a filter rule, this should work but I haven't tested it.

filters:
  - syscall: 0
    message_type: 1305
    regex: .*

from go-audit.

added filter but still coming in. While we probably won't be using this version of ubuntu, it would be nice to see the filter actually work.

from go-audit.

thank you that fixed it.

from go-audit.

This doesn't work any more in the latest master in 2018.

audit.go line 299:
if af.syscall == "" {
return filters, fmt.Errorf("Filter %d is missing the syscall entry", i+1)
}

How can I skip message_type 1305? My audit logs are overwhelmingly full of it.

from go-audit.