mozilla / audit-go Goto Github PK

Running the code manually often gives me errors like the one bellow :

2015/01/26 15:55:35 Acknowledged!!
2015/01/26 15:55:35 NLMSG_ERROR Received..
2015/01/26 15:55:35 Enabled Audit!!
2015/01/26 15:55:35 Acknowledged!!
2015/01/26 15:55:35 Acknowledged!!
2015/01/26 15:55:35 Acknowledged!!
2015/01/26 15:55:35 Set pid successful!!
2015/01/26 15:55:35 Deleting all rules
2015/01/26 15:55:35 NLMSG_ERROR

unexpected fault address 0x0
fatal error: fault
[signal 0xb code=0x80 addr=0x0 pc=0x42b124]

goroutine 16 [running]:
runtime.throw(0x5d20a2)
/usr/lib/golang/src/pkg/runtime/panic.c:520 +0x69 fp=0x7fbb8870a2e8 sp=0x7fbb8870a2d0
runtime.sigpanic()
/usr/lib/golang/src/pkg/runtime/os_linux.c:240 +0x13f fp=0x7fbb8870a300 sp=0x7fbb8870a2e8
runtime.memmove(0xc208017190, 0x6f70732f7261762f, 0x13)
/usr/lib/golang/src/pkg/runtime/memmove_amd64.s:141 +0x214 fp=0x7fbb8870a308 sp=0x7fbb8870a300
_/audit-go/netlinkAudit.(*AuditRuleData).ToWireFormat(0xc208060010, 0x0, 0x0, 0x0)
/audit-go/netlinkAudit/libaudit.go:96 +0x34d fp=0x7fbb8870a3a8 sp=0x7fbb8870a308
_/audit-go/netlinkAudit.AuditDeleteRuleData(0xc20803e020, 0xc208060010, 0x200000004, 0x0, 0x0)
/audit-go/netlinkAudit/libaudit.go:732 +0x19c fp=0x7fbb8870a8d0 sp=0x7fbb8870a3a8
_/audit-go/netlinkAudit.DeleteAllRules(0xc20803e020, 0x0, 0x0)
/audit-go/netlinkAudit/libaudit.go:805 +0xa32 fp=0x7fbb8870aa90 sp=0x7fbb8870a8d0
_/audit-go/netlinkAudit.SetRules(0xc20803e020, 0x0, 0x0)
/audit-go/netlinkAudit/libaudit.go:866 +0x4a7 fp=0x7fbb8870ae70 sp=0x7fbb8870aa90
main.main()
/audit-go/main.go:53 +0x867 fp=0x7fbb8870af50 sp=0x7fbb8870ae70
runtime.main()
/usr/lib/golang/src/pkg/runtime/proc.c:247 +0x11a fp=0x7fbb8870afa8 sp=0x7fbb8870af50
runtime.goexit()
/usr/lib/golang/src/pkg/runtime/proc.c:1445 fp=0x7fbb8870afb0 sp=0x7fbb8870afa8
created by _rt0_go
/usr/lib/golang/src/pkg/runtime/asm_amd64.s:97 +0x120

goroutine 17 [runnable]:
runtime.MHeap_Scavenger()
/usr/lib/golang/src/pkg/runtime/mheap.c:507
runtime.goexit()
/usr/lib/golang/src/pkg/runtime/proc.c:1445

goroutine 18 [runnable]:
bgsweep()
/usr/lib/golang/src/pkg/runtime/mgc0.c:1976
runtime.goexit()
/usr/lib/golang/src/pkg/runtime/proc.c:1445

goroutine 19 [runnable]:
runfinq()
/usr/lib/golang/src/pkg/runtime/mgc0.c:2606
runtime.goexit()
/usr/lib/golang/src/pkg/runtime/proc.c:1445
exit status 2

Go-audit log files are generating as a binary file. whenever we try to open the file we are prompted with below message.

"goaudit.log" may be a binary file. See it anyway?

If we give "yes" and we can able to view but the contents are filled with some junk characters(^@^@^@^@^@^@^@^@^@^) for few pages. After scrolling few pages down then we can able to view the actual logs.

Can you suggest us how to avoid junk characters getting appended to the log file?

Also let us know why the file format is showing as binary file?

As of January 1 2019, Mozilla requires that all GitHub projects include this CODE_OF_CONDUCT.md file in the project root. The file has two parts:

1. Required Text - All text under the headings Community Participation Guidelines and How to Report, are required, and should not be altered.
2. Optional Text - The Project Specific Etiquette heading provides a space to speak more specifically about ways people can work effectively and inclusively together. Some examples of those can be found on the Firefox Debugger project, and Common Voice. (The optional part is commented out in the raw template file, and will not be visible until you modify and uncomment that part.)

If you have any questions about this file, or Code of Conduct policies and procedures, please see Mozilla-GitHub-Standards or email [email protected].

(Message COC001)

basically eliminate-

2015/11/20 15:34:23 Unknown: 1327
2015/11/20 15:35:11 Unknown: 1326
2015/11/20 15:35:53 Unknown: 1326
2015/11/20 15:36:18 Unknown: 1326
2015/11/20 15:36:23 Unknown: 1326
2015/11/20 15:36:23 Unknown: 1326
2015/11/20 15:36:29 Unknown: 1326

Hi,

Is there any way to stream events from go-audit log files to s3 bucket in realtime? Can you suggest how this can be achieved. Couldn't find any plugins relevant to this feature enabled with go-audit or will it be achieved only via any third party tools like logstash or anything else. Kindly suggest.

I did notice that from time to time the MAX_AUDIT_MESSAGE_LENGTH is exceeded. What is a safe value there ? Will this options be documented ?