| blob | fe8ddab719e374788118520fac35378bdfc58e4c |
1 '\" te
2 .\" Copyright (c) 2017 Peter Tribble
3 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH AUDIT_SYSLOG 5 "Mar 6, 2017"
8 .SH NAME
9 audit_syslog \- realtime conversion of audit data to syslog messages
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fB/usr/lib/security/audit_syslog.so\fR
14 .fi
16 .SH DESCRIPTION
17 .LP
18 The \fBaudit_syslog\fR plugin module for audit,
19 \fB/usr/lib/security/audit_syslog.so\fR, provides realtime conversion of
20 audit data to syslog-formatted (text) data and sends it to a syslog
21 daemon as configured in \fBsyslog.conf\fR(4).
22 .sp
23 .LP
24 Messages to \fBsyslog\fR are written if the \fBaudit_syslog\fR plugin is
25 activated and configured using \fBauditconfig\fR(1M).
26 .sp
27 .LP
28 Syslog messages are generated with the facility code of
29 \fBLOG_AUDIT\fR (\fBaudit\fR in \fBsyslog.conf\fR(4)) and severity of
30 \fBLOG_NOTICE\fR. Audit \fBsyslog\fR messages contain data selected from the
31 tokens described for the binary audit log. (See \fBaudit.log\fR(4)). As with
32 all \fBsyslog\fR messages, each line in a \fBsyslog\fR file consists of two
33 parts, a \fBsyslog\fR header and a message.
34 .sp
35 .LP
36 The syslog header contains the date and time the message was generated, the
37 host name from which it was sent, \fBauditd\fR to indicate that it was
38 generated by the audit daemon, an ID field used internally by \fBsyslogd\fR,
39 and \fBaudit.notice\fR indicating the \fBsyslog\fR facility and severity
40 values. The \fBsyslog\fR header ends with the characters \fB]\fR, that is, a
41 closing square bracket and a space.
42 .sp
43 .LP
44 The message part starts with the event type from the header token. All
45 subsequent data appears only if contained in the original audit record and
46 there is room in the 1024-byte maximum length \fBsyslog\fR line. In the
47 following example, the backslash (\fB\e\fR) indicates a continuation; actual
48 \fBsyslog\fR messages are contained on one line:
49 .sp
50 .in +2
51 .nf
52 Oct 31 11:38:08 smothers auditd: [ID 917521 audit.notice] chdir(2) ok\e
53 session 401 by joeuser as root:other from myultra obj /export/home
54 .fi
55 .in -2
56 .sp
58 .sp
59 .LP
60 In the preceding example, \fBchdir(2)\fR is the event type. Following this
61 field is additional data, described below. This data is omitted if it is not
62 contained in the source audit record.
63 .sp
64 .ne 2
65 .na
66 \fB\fBok\fR or \fBfailed\fR\fR
67 .ad
68 .RS 21n
69 Comes from the return or exit token.
70 .RE
72 .sp
73 .ne 2
74 .na
75 \fB\fBsession \fI<#>\fR\fR\fR
76 .ad
77 .RS 21n
78 \fI<#>\fR is the session ID from the subject token.
79 .RE
81 .sp
82 .ne 2
83 .na
84 \fB\fBby \fI<name>\fR\fR\fR
85 .ad
86 .RS 21n
87 \fI<name>\fR is the audit ID from the subject token.
88 .RE
90 .sp
91 .ne 2
92 .na
93 \fB\fBas \fI<name>\fR:\fI<group>\fR\fR\fR
94 .ad
95 .RS 21n
96 \fI<name>\fR is the effective user ID and \fI<group>\fR is the effective group
97 ID from the subject token.
98 .RE
100 .sp
101 .ne 2
102 .na
103 \fB\fBin\fR \fI<zone name>\fR\fR
104 .ad
105 .RS 21n
106 The zone name. This field is generated only if the \fBzonename\fR audit policy
107 is set.
108 .RE
110 .sp
111 .ne 2
112 .na
113 \fB\fBfrom \fI<terminal>\fR\fR\fR
114 .ad
115 .RS 21n
116 \fI<terminal>\fR is the text machine address from the subject token.
117 .RE
119 .sp
120 .ne 2
121 .na
122 \fB\fBobj \fI<path>\fR\fR\fR
123 .ad
124 .RS 21n
125 \fI<path>\fR is the path from the path token The path can be truncated from the
126 left if necessary to fit it on the line. Truncation is indicated by leading
127 ellipsis (\fB\&...\fR).
128 .RE
130 .sp
131 .ne 2
132 .na
133 \fB\fBproc_uid \fI<owner>\fR\fR\fR
134 .ad
135 .RS 21n
136 \fI<owner>\fR is the effective user ID of the process owner.
137 .RE
139 .sp
140 .ne 2
141 .na
142 \fB\fBproc_auid \fI<owner>\fR\fR\fR
143 .ad
144 .RS 21n
145 \fI<owner>\fR is the audit ID of the process owner.
146 .RE
148 .sp
149 .LP
150 The following are example \fBsyslog\fR messages:
151 .sp
152 .in +2
153 .nf
154 Nov 4 8:27:07 smothers auditd: [ID 175219 audit.notice] \e
155 system booted
157 Nov 4 9:28:17 smothers auditd: [ID 752191 audit.notice] \e
158 login - rlogin ok session 401 by joeuser as joeuser:staff from myultra
160 Nov 4 10:29:27 smothers auditd: [ID 521917 audit.notice] \e
161 access(2) ok session 255 by janeuser as janeuser:staff from \e
162 129.146.89.30 obj /etc/passwd
163 .fi
164 .in -2
165 .sp
167 .SH OBJECT ATTRIBUTES
168 .LP
169 The \fBp_flags\fR attribute is used to further filter audit data being sent
170 to the \fBsyslog\fR daemon beyond the default and non-attributable
171 audit flags. The parameter is a comma-separated list; each
172 item represents an audit class (see \fBaudit_class\fR(4)) and is specified
173 using the same syntax used by \fBauditconfig\fR for the \fB-setflags\fR and
174 \fB-setnaflags\fR options. The default (no \fBp_flags\fR set) is that no
175 audit records are generated.
176 .SH EXAMPLES
177 .LP
178 \fBExample 1 \fREnabling the plugin and selecting events
179 .sp
180 .LP
181 The command below enables the \fBaudit_syslog\fR plugin and sets the
182 \fBp_flags\fR filter to allow class records for \fBlo\fR but
183 allows class records for \fBam\fR for failures only. Because no other
184 classes are listed, not other audit records will be sent to
185 syslog. You cannot add classes to those defined by means of
186 \fBflags\fR and \fBnaflags\fR. You can only remove them.
188 .sp
189 .in +2
190 .nf
191 # autditconf -setplugin audit_syslog active p_flags=lo,-am
192 .fi
193 .in -2
194 .sp
196 \fBExample 2 \fRViewing the plugin configuration
197 .sp
198 .LP
199 The command below enables shows the \fBaudit_syslog\fR plugin configuration.
201 .sp
202 .in +2
203 .nf
204 # auditconfig -getplugin audit_syslog
205 Plugin: audit_syslog (active)
206 Attributes: p_flags=lo,-am;
207 .fi
208 .in -2
209 .sp
211 .SH ATTRIBUTES
212 .LP
213 See \fBattributes\fR(5) for a description of the following attributes:
214 .sp
216 .sp
217 .TS
218 box;
219 c | c
220 l | l .
221 ATTRIBUTE TYPE ATTRIBUTE VALUE
222 _
223 MT Level MT-Safe
224 _
225 Interface Stability See below.
226 .TE
228 .sp
229 .LP
230 The message format and message content are Uncommitted. The configuration
231 parameters are Committed.
232 .SH SEE ALSO
233 .LP
234 \fBauditd\fR(1M), \fBauditconfig\fR(1M), \fBaudit_class\fR(4),
235 \fBsyslog.conf\fR(4), \fBattributes\fR(5)
236 .SH NOTES
237 .LP
238 Use of the \fBplugin\fR configuration line to include \fBaudit_syslog.so\fR
239 requires that \fB/etc/syslog.conf\fR is configured to store \fBsyslog\fR
240 messages of facility \fBaudit\fR and severity \fBnotice\fR or above in a file
241 intended for audit records. An example of such a line in
242 \fBsyslog.conf\fR is:
243 .sp
244 .in +2
245 .nf
246 audit.notice /var/audit/audit.log
247 .fi
248 .in -2
249 .sp
251 .sp
252 .LP
253 Messages from \fBsyslog\fR are sent to remote \fBsyslog\fR servers by means of
254 UDP, which does not guarantee delivery or ensure the correct order of arrival
255 of messages.
256 .sp
257 .LP
258 If the \fBp_flags\fR attribute results in no classes
259 being preselected, an error is reported by means of a \fBsyslog\fR alert with
260 the \fBLOG_DAEMON\fR facility code.
261 .sp
262 .LP
263 The time field in the \fBsyslog\fR header is generated by \fBsyslog\fR(3C) and
264 only approximates the time given in the binary audit log. Normally the time
265 field shows the same whole second or at most a few seconds difference.