[BUG] /var/log/syslog grows with 100KB/s about ansible-role-hardening HOT 6 CLOSED

Hi @AdrianPop, this is expected behavior when auditd_apply_audit_rules: true, https://github.com/konstruktoid/ansible-role-hardening/blob/master/defaults/main/auditd.yml#L2C1-L2C31

from ansible-role-hardening.

@konstruktoid yes, indeed. I've read the config files and figured that out in the end.

But which rule from here https://github.com/konstruktoid/ansible-role-hardening/blob/master/templates/etc/audit/rules.d/hardening.rules.j2 produces the output from above for docker?

One of them seems this -w /tmp -p wxa -k tmp, but I cannot identify the other one for docker.

from ansible-role-hardening.

Also, these rules are not working as expected imho

auditd_max_log_file: 8
auditd_max_log_file_action: keep_logs
auditd_num_logs: 5

According to auditd docs, when max_log_file_action is set to keep_logs it ignores the num_logs.

I've managed to make it work by changing: max_log_file_action = rotate

from ansible-role-hardening.

Also, these rules are not working as expected imho

auditd_max_log_file: 8
auditd_max_log_file_action: keep_logs
auditd_num_logs: 5

According to auditd docs, when max_log_file_action is set to keep_logs it ignores the num_logs.

I've managed to make it work by changing: max_log_file_action = rotate

Nice catch, I'll update this settings later today. auditd_max_log_file can most likely be increased as well.

from ansible-role-hardening.

@konstruktoid yes, indeed. I've read the config files and figured that out in the end.

But which rule from here https://github.com/konstruktoid/ansible-role-hardening/blob/master/templates/etc/audit/rules.d/hardening.rules.j2 produces the output from above for docker?

One of them seems this -w /tmp -p wxa -k tmp, but I cannot identify the other one for docker.

I believe a couple of log entries are missing from your post, but please try aureport --key docker, aureport -t or aureport -x.

from ansible-role-hardening.

I've copied only a few logs, as you can see, all of them have the same logging second: :58

from ansible-role-hardening.