Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bulk Failed Syscall #1721

Open
MZSN opened this issue May 21, 2019 · 11 comments
Open

Bulk Failed Syscall #1721

MZSN opened this issue May 21, 2019 · 11 comments

Comments

@MZSN
Copy link

MZSN commented May 21, 2019

  1. 05/21/19 07:25:13 unlink 31075 ossec-syscheckd (username who installed agent) 4783069
  2. 05/21/19 07:25:13 unlink 31075 ossec-syscheckd (username who installed agent) 4783068
  3. 05/21/19 07:25:14 unlink 31075 ossec-syscheckd (username who installed agent) 4783071
  4. 05/21/19 07:25:14 unlink 31075 ossec-syscheckd (username who installed agent) 4783070
  5. 05/21/19 07:25:15 unlink 31075 ossec-syscheckd (username who installed agent) 4783073

Why do I get these bulk failed syscall at ossec agent? The agent is running at default configuration with file integrity module enabled in ossec.conf, please respond how to control this bulk amount of failed syscalls

@MZSN
Copy link
Author

MZSN commented May 21, 2019

Also the user who installed is privileged user, also the audit file access report is also showing that ossec is accessing files with same username who installed as follows
4 /var/ossec/queue/diff/local/tmp//*****
4 /var/ossec/queue/diff/local/var/
/
///
4 /var/ossec/queue/diff/local/var/////**
4 /var/ossec/queue/diff/local/var///////*****
4 /var/ossec/queue/diff/local/var/
//////*****
4 /var/ossec/queue/diff/local/var/
//////*****
4 /var/ossec/queue/diff/local/var/
//////*****
4 /var/ossec/queue/diff/local/var/
//////*****
4 /var/ossec/queue/diff/local/var/
//////*****
4 /var/ossec/queue/diff/local/var/
/////*

@ddpbsd
Copy link
Member

ddpbsd commented May 27, 2019

I've never seen these messages. Could you provide more context?

@MZSN
Copy link
Author

MZSN commented May 30, 2019

The audit daemon report is printing these results. Failed syscalls. Can you explain me why I get these failed syscalls?

@MZSN
Copy link
Author

MZSN commented May 30, 2019

And also why the privileged user is appearing in these failed syscalls? Please respond

@MZSN
Copy link
Author

MZSN commented Jun 18, 2019

Please respond

@ddpbsd
Copy link
Member

ddpbsd commented Jun 18, 2019

Something on your system (selinux?) is potentially blocking unlink syscalls I guess.
The only thing I can think of in syscheckd that might call unlink is the diff checking functions.

@MZSN
Copy link
Author

MZSN commented Jun 18, 2019

but why do I see the same results in my file access report of aureport

@ddpbsd
Copy link
Member

ddpbsd commented Jun 18, 2019

Because something is blocking the syscalls? I really don't know, and I don't think I have enough information to even investigate it.

@MZSN
Copy link
Author

MZSN commented Jun 18, 2019

4 /var/ossec/queue/diff/local/tmp//*****
4 /var/ossec/queue/diff/local/var/////
4 /var/ossec/queue/diff/local/var/////**
4 /var/ossec/queue/diff/local/var///////*****
4 /var/ossec/queue/diff/local/var///////*****
4 /var/ossec/queue/diff/local/var///////*****
4 /var/ossec/queue/diff/local/var///////*****
4 /var/ossec/queue/diff/local/var///////*****
4 /var/ossec/queue/diff/local/var///////*****
4 /var/ossec/queue/diff/local/var//////*

@MZSN
Copy link
Author

MZSN commented Jun 18, 2019

These files are access by the user who installed ossec agent, without him actually accessing it.

@ddpbsd
Copy link
Member

ddpbsd commented Jun 18, 2019

4 /var/ossec/queue/diff/local/tmp//***** doesn't really tell me anything. I don't know what it is. The extra slashes and asterisks don't make sense to me.
Look through your audit.log maybe? Try to figure out what's going on.
What OS? Distribution? Version? Is selinux installed? Is it blocking? Are there any related errors? Are you using the diffing functionality in syscheckd? Are the files being cleaned up?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants