Audit Prelude Logout Tracking

[Dan Gruhn]

LC Bruzenak wrote:
> On Wed, 2009-02-18 at 16:44 -0600, LC Bruzenak wrote:
>   
>> On Wed, 2009-02-18 at 16:58 -0500, Dan Gruhn wrote:
>>     
>>> I''m working on an X86_64  RHEL 5.2 system and for NISPOM Chapt. 8 I'm 
>>> looking to modify the audisp-prelude plugin so that I can get logout 
>>> events displayed.
>>>
>>> I see the information in the audit.log as USER_END and have done a small 
>>> mod in the handle_event routine in audisp-prelude.c so that it looks for 
>>> AUDIT_USER_END but I've run across the following things:
>>>
>>> 1) sshd goes through a login/logout cycle ending in USER_END and all is 
>>> good.
>>> node=node01 type=USER_END msg=audit(1234979707.894:203): user pid=7422 
>>> uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 
>>> msg='PAM: session close acct="root" : exe="/usr/sbin/sshd" 
>>> (hostname=master, addr=10.1.4.100, terminal=ssh res=success)'
>>>
>>>
>>>       
>
> Dan,
>
> The other question I had was, I suppose you see the AUDIT_USER_LOGIN
> event type which triggers the prelude event (in audisp-prelude.c). I
> would think that the matching AUDIT_USER_LOGOUT would be what you want
> right?
>
> Can you find these events with ausearch like this?:
>
> # ausearch -ts today -i -m USER_LOGIN
> ...and...
> #ausearch -ts today -i -m USER_LOGOUT
>
>
> LCB
>
>   
LCB,

Thanks for the tip on the hostname/addr info is only for remote access 
information.

 Although this seemed like the right place to look, I don't see 
USER_LOGOUT events in my audit logs, this is why I mentioned the 
USER_END events.  Do you remember USER_LOGOUT working back when you 
tried before?

I am interested in the patches that you make to audisp-prelude.c.  Do 
you think they might be useful to me in my NISPOM quest?  If so, are 
they patches from 1.7.11 and could you send me a copy?

Thanks,

Dan