[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Getting Process name instead of PPID



Hi,

I have a strange issue with iptables on my server. It was getting loaded automatically even if i stopped it. I set auditing but couldn't find what REALLY triggers iptables.
Here's snip from ausearch output


----
time->Thu Sep  8 20:12:35 2011
type=PATH msg=audit(1315492955.754:891146): item=1 name=(null) inode=17465407 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1315492955.754:891146): item=0 name="/sbin/iptables" inode=32210958 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1315492955.754:891146):  cwd="/root"
type=EXECVE msg=audit(1315492955.754:891146): argc=2 a0="iptables" a1="-L"
type=SYSCALL msg=audit(1315492955.754:891146): arch=c000003e syscall=59 success=yes exit=0 a0=1c70fbc0 a1=1c6ff6f0 a2=1c6effe0 a3=8 items=2 ppid=11061 pid=11622 auid=11001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=92491 comm="iptables" exe="/sbin/iptables" key="iptable_load_audit"
----
time->Thu Sep  8 20:23:28 2011
type=PATH msg=audit(1315493608.196:891434): item=1 name=(null) inode=17465407 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1315493608.196:891434): item=0 name="/sbin/iptables" inode=32210958 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1315493608.196:891434):  cwd="/"
type=EXECVE msg=audit(1315493608.196:891434): argc=9 a0="/sbin/iptables" a1="--table" a2="nat" a3="--delete" a4="POSTROUTING" a5="--source" a6="192.168.122.0/255.255.255.0" a7="--jump" a8="MASQUERADE"
type=SYSCALL msg=audit(1315493608.196:891434): arch=c000003e syscall=59 success=yes exit=0 a0=5527080 a1=5530840 a2=7fffcda0bf60 a3=3ce1e16220 items=2 ppid=5564 pid=17660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/sbin/iptables" key="iptable_load_audit"

Notable difference between two entries are of tty. In second, it says tty=none. based on this,It can be concluded that some application is accessing iptables. I believe that if i can get name of PPID, it can help me in tracing this further.

Any advice?

Regards,
Nehal Dattani

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]