How to enable periods processing with systemd audit [solved]

vaxbrat · l33t Joined: 05 Oct 2005 Posts: 731 Location: DC Burbs

I wrote a framework of python scripts over the years to handle the collection and management of auditing on a number of platforms. For servers that are up 24x7, it's simple enough to put an entry in the root crontab that rotates the audit logs once a day and then does some post processing to convert the raw logs into an sqlite database for later review.

Things get a little more complicated when dealing with a server that is only used for "periods processing", that is it is only booted as necessary and then shut down and locked up when not in use. The logs must get broken up and processed in a sane fashion so that a reviewer can look at their reports on a day by partial day basis.

In the past this was simple enough to do with sysvinit, openrc and upstart based init scripts. I simply hooked a python script into the stop function in /etc/init.d/auditd to do the renaming and post processing after auditd was shut down. The system waits synchronously until the script exits before going into unmount and final shutdown. However Systemd appears to making life a lot harder for me to implement this.

I found the /usr/lib/systemd/system/auditd.service file and then started looking into the ExecStop and ExecStopPost options for hooking in my script. The docs are a bit vague, but I get the impression that using ExecStopPost starts my script as I want after auditd is dead, but the whole thing is asynchronous. Thus my stuff just barely gets started before the system goes into final shutdown. If I put things in ExecStop instead, it would appear that I need to hunt down the pidfile and send the SIGTERM on my own if I want my stuff to run on a cold audit.log. On the plus side, I get the impression that these commands force things to be synchronous. Hopefully that would sabotage things enough for systemd to keep things mounted and up until auditd.service is finally terminated.

Can anybody confirm this behavior or has anybody done something similar?

vaxbrat · l33t Joined: 05 Oct 2005 Posts: 731 Location: DC Burbs

It looks like the trick is to use the ExecStop and not ExecStopPost functions. I had to send a kill -TERM and then do my script as follows. This file hides in /usr/lib/systemd/system/auditd.service on centos/rhel7. I presume it would be the same for a systemd based gentoo, but I would never let that sort of thing happen :wink: