Seeking Input - CCI-001488 - What do do when audit fails?

Steve Grubb sgrubb at redhat.com
Thu Apr 26 11:55:11 UTC 2012


On Wednesday, April 25, 2012 11:49:31 PM Shawn Wells wrote:
> CCI-001488 requires that we do something when the auditd system fails.
> Right now we have no rules for that.
> 
> For Red Hat's LSPP profiles we set failure mode to panic. Thoughts?
> Objections?

If you are on a bare metal machine and its a high value asset, then this is 
probably what you want to do. But think about what would happen if this were in 
the hypervisor with 10 VM's running on top of it. Would you want all 10 VM's and 
the host to drop dead without saving state? :)

Normally the panic will only trigger when you overflow the internal queue of the 
kernel. But the user space daemon can also get itself into trouble and it has a 
range of options to deal with how to handle various problems. So, you may need 
several checks. One for the kernel, a couple for auditd, a couple for audispd, 
and possibly some for audisp-remote.

-Steve


More information about the scap-security-guide mailing list