To enable OS Audit to look for processes being killed please follow the steps on Linux:
# yum install auditd
Enable the auditd service to start at boot and start it using the “service” command.
# systemctl enable auditd
# service start auditd
Configuring auditd rule to Monitor SYSCALL
Let’s create a rule to monitor the “kill” SYSCALL which can be used to find all the killing a process.
- Add the below rule to the auditd rules configuration file /etc/audit/rules.d/audit.rules:
# vi /etc/audit/rules.d/audit.rules
-a exit,always -F arch=b64 -S kill -k kill_rule
Note: “arch” is the CPU architecture of the syscall. If the system is 32 bit OS, then set it with “arch=b32”.
- Restart the auditd service for the new rule to be effective.
# service restart auditd
- Verify if the defined rules are active, using the “auditctl -l” command.
# auditctl -l
-a always,exit -F arch=b64 -S kill -F key=kill_rule
Verify: Check if the rule just created actually works or not by simply initiating a “sleep 500” process and kill it. This should generate an audit log with all the details like who killed the process (uid) with what program/command etc.
- Spawn a simple sleep process in background.
# sleep 600 &
- Check for the process ID of the sleep process and kill it.
# ps -ef | grep sleep
root 2089 1784 0 15:12 pts/0 00:00:00 sleep 600
# kill -9 2089
- Check for the audit log file /var/log/audit/audit.log for the kill audit logs. The log should look similar to shown below.
# tail -f /var/log/audit/audit.log
type=SYSCALL msg=audit(1529507591.700:304): arch=c000003e syscall=62 success=yes exit=0 a0=829 a1=9 a2=0 a3=829 items=0 ppid=1783 pid=1784 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="kill_rule"
type=OBJ_PID msg=audit(1529507591.700:304): opid=2089 oauid=1001 ouid=0 oses=1 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 ocomm="sleep"
type=PROCTITLE msg=audit(1529507591.700:304): proctitle="-bash"
- Sometimes the audit log can be difficult to look for the logs we are interested in. The “ausearch” command can be also used with the key defined with the rule. For example:
# ausearch -k kill_rule
type=PROCTITLE msg=audit(1529507591.700:304): proctitle="-bash"
type=OBJ_PID msg=audit(1529507591.700:304): opid=2089 oauid=1001 ouid=0 oses=1 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 ocomm="sleep"
type=SYSCALL msg=audit(1529507591.700:304): arch=c000003e syscall=62 success=yes exit=0 a0=829 a1=9 a2=0 a3=829 items=0 ppid=1783 pid=1784 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="kill_rule"
- In a test environment, start an OpenEdge process and then ues UNIX kill signals to kill it.
