johntdyer

@mgutt, nope, nothing at all. I restarted yesterday to try and get the kernel audit enabled and in 22hours I've gotten 95,593 writes to the USB

@mgutt Tried this and it didnt work. I added the audit=1 to the append optionsk, restarted the machine, installed the packaghe and it wont start or allow me to watch a file. Have you actually gotten this to work yourself ? root@vault:/var/log# auditd -s enable Aug 9 07:05:42 vault auditd[8117]: Error - audit support not in kernel Aug 9 07:05:42 vault auditd[8117]: Cannot open netlink audit socket Aug 9 07:05:42 vault auditd[8117]: The audit daemon is exiting. Aug 9 07:05:42 vault auditd: Cannot daemonize (Success) Aug 9 07:05:42 vault auditd: The audit daemon is exiting. root@vault:/var/log# auditctl -w /boot/config/domain.cfg Error - audit support not in kernel Cannot open netlink audit socket syslinux.cfg root@vault:/var/log# cat /boot/syslinux/syslinux.cfg default menu.c32 menu title Lime Technology, Inc. prompt 0 timeout 50 label Unraid OS menu default kernel /bzimage append initrd=/bzroot audit=1 label Unraid OS GUI Mode kernel /bzimage append initrd=/bzroot,/bzroot-gui label Unraid OS Safe Mode (no plugins, no GUI) kernel /bzimage append initrd=/bzroot unraidsafemode label Unraid OS GUI Safe Mode (no plugins) kernel /bzimage append initrd=/bzroot,/bzroot-gui unraidsafemode label Memtest86+ kernel /memtest root@vault:/var/log# root@vault:/var/log# cat /proc/cmdline BOOT_IMAGE=/bzimage initrd=/bzroot audit=1 root@vault:/var/log# uptime 07:08:29 up 42 min, 1 user, load average: 3.61, 3.56, 3.20 root@vault:/var/log#

@mgutt - Where do I set the kernel options for Unraid ?

@mgutt - Seems to install but I cant run it root@vault:/usr/local/src/audit/audit# auditd -f Config file /etc/audit/auditd.conf opened for parsing log_file_parser called with: /var/log/audit/audit.log log_format_parser called with: RAW log_group_parser called with: root priority_boost_parser called with: 4 flush_parser called with: INCREMENTAL freq_parser called with: 20 num_logs_parser called with: 5 qos_parser called with: lossy dispatch_parser called with: /sbin/audispd name_format_parser called with: NONE max_log_size_parser called with: 6 max_log_size_action_parser called with: ROTATE space_left_parser called with: 75 space_action_parser called with: SYSLOG action_mail_acct_parser called with: root admin_space_left_parser called with: 50 admin_space_left_action_parser called with: SUSPEND disk_full_action_parser called with: SUSPEND disk_error_action_parser called with: SUSPEND tcp_listen_queue_parser called with: 5 tcp_max_per_addr_parser called with: 1 tcp_client_max_idle_parser called with: 0 enable_krb5_parser called with: no GSSAPI support is not enabled, ignoring value at line 30 krb5_principal_parser called with: auditd GSSAPI support is not enabled, ignoring value at line 31 Error - audit support not in kernel Cannot open netlink audit socket The audit daemon is exiting. root@vault:/usr/local/src/audit/audit#

@mgutt ok, so I installed inotify container and see a temp file being written and the copied over the domain.cfg [2021-07-08 20:28:57] test: CONFIGURATION: [2021-07-08 20:28:57] test: WATCH_DIR=/dir1 [2021-07-08 20:28:57] test: SETTLE_DURATION=5 [2021-07-08 20:28:57] test: MAX_WAIT_TIME=300 [2021-07-08 20:28:57] test: MIN_PERIOD=600 [2021-07-08 20:28:57] test: COMMAND= [2021-07-08 20:28:57] test: USER_ID=0 [2021-07-08 20:28:57] test: GROUP_ID=0 [2021-07-08 20:28:57] test: UMASK=0600 [2021-07-08 20:28:57] test: DEBUG=True [2021-07-08 20:28:57] test: USE_POLLING=False [2021-07-08 20:28:57] test: IGNORE_EVENTS_WHILE_COMMAND_IS_RUNNING=True [2021-07-08 20:28:57] test: Starting monitor for test [2021-07-08 20:28:57] test: Using native change detection to detect changes [2021-07-08 20:28:58] test: Waiting for new change [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR3Awnl', wd=4, mask=IN_CREATE, cookie=0, name=b'sedR3Awnl'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR3Awnl', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sedR3Awnl'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR3Awnl', wd=4, mask=IN_MODIFY, cookie=0, name=b'sedR3Awnl'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed4t3UOe', wd=4, mask=IN_CREATE, cookie=0, name=b'sed4t3UOe'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed4t3UOe', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sed4t3UOe'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed4t3UOe', wd=4, mask=IN_MODIFY, cookie=0, name=b'sed4t3UOe'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR3Awnl', wd=4, mask=IN_CREATE, cookie=0, name=b'sedR3Awnl'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR3Awnl', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sedR3Awnl'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR3Awnl', wd=4, mask=IN_MODIFY, cookie=0, name=b'sedR3Awnl'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed4t3UOe', wd=4, mask=IN_CREATE, cookie=0, name=b'sed4t3UOe'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed4t3UOe', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sed4t3UOe'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed4t3UOe', wd=4, mask=IN_MODIFY, cookie=0, name=b'sed4t3UOe'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR3Awnl', wd=4, mask=IN_MOVED_FROM, cookie=400522, name=b'sedR3Awnl'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/domain.cfg', wd=4, mask=IN_MOVED_TO, cookie=400522, name=b'domain.cfg'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed4t3UOe', wd=4, mask=IN_MOVED_FROM, cookie=400523, name=b'sed4t3UOe'> [2021-07-08 20:28:59] test: in-event <InotifyEvent: src_path=b'/dir1/config/domain.cfg', wd=4, mask=IN_MOVED_TO, cookie=400523, name=b'domain.cfg'> [2021-07-08 20:28:59] test: Detected change to file /dir1/config/sedR3Awnl [2021-07-08 20:28:59] test: Waiting for watch directory to stabilize for 5 seconds before triggering command [2021-07-08 20:29:00] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedo5ctBu', wd=4, mask=IN_CREATE, cookie=0, name=b'sedo5ctBu'> [2021-07-08 20:29:00] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedo5ctBu', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sedo5ctBu'> [2021-07-08 20:29:00] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedo5ctBu', wd=4, mask=IN_MODIFY, cookie=0, name=b'sedo5ctBu'> [2021-07-08 20:29:00] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedo5ctBu', wd=4, mask=IN_MOVED_FROM, cookie=400526, name=b'sedo5ctBu'> [2021-07-08 20:29:00] test: in-event <InotifyEvent: src_path=b'/dir1/config/domain.cfg', wd=4, mask=IN_MOVED_TO, cookie=400526, name=b'domain.cfg'> [2021-07-08 20:29:05] test: Watch directory stabilized for 5 seconds. Triggering command. [2021-07-08 20:29:05] test: Running command with user ID 0, group ID 0, and umask 0600 [2021-07-08 20:29:05] test: vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv [2021-07-08 20:29:05] Found existing user "root" with the proper user ID and group ID. Skipping creation of user and group... [2021-07-08 20:29:05] Running command as user "root"... Usage: /sbin/setuser USERNAME COMMAND [args..] [2021-07-08 20:29:05] test: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [2021-07-08 20:29:05] test: Finished running command. Exit code was 1 [2021-07-08 20:29:05] test: Waiting for new change [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedmyN7sP', wd=4, mask=IN_CREATE, cookie=0, name=b'sedmyN7sP'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedmyN7sP', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sedmyN7sP'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedmyN7sP', wd=4, mask=IN_MODIFY, cookie=0, name=b'sedmyN7sP'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed130Gz2', wd=4, mask=IN_CREATE, cookie=0, name=b'sed130Gz2'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed130Gz2', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sed130Gz2'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed130Gz2', wd=4, mask=IN_MODIFY, cookie=0, name=b'sed130Gz2'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedmyN7sP', wd=4, mask=IN_MOVED_FROM, cookie=400575, name=b'sedmyN7sP'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/domain.cfg', wd=4, mask=IN_MOVED_TO, cookie=400575, name=b'domain.cfg'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/sed130Gz2', wd=4, mask=IN_MOVED_FROM, cookie=400577, name=b'sed130Gz2'> [2021-07-08 20:29:19] test: in-event <InotifyEvent: src_path=b'/dir1/config/domain.cfg', wd=4, mask=IN_MOVED_TO, cookie=400577, name=b'domain.cfg'> [2021-07-08 20:29:19] test: Detected change to file /dir1/config/sedmyN7sP [2021-07-08 20:29:19] test: Waiting for watch directory to stabilize for 5 seconds before triggering command [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR27qE6', wd=4, mask=IN_CREATE, cookie=0, name=b'sedR27qE6'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR27qE6', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sedR27qE6'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR27qE6', wd=4, mask=IN_MODIFY, cookie=0, name=b'sedR27qE6'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR27qE6', wd=4, mask=IN_MOVED_FROM, cookie=400580, name=b'sedR27qE6'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/domain.cfg', wd=4, mask=IN_MOVED_TO, cookie=400580, name=b'domain.cfg'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR27qE6', wd=4, mask=IN_CREATE, cookie=0, name=b'sedR27qE6'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR27qE6', wd=4, mask=IN_ATTRIB, cookie=0, name=b'sedR27qE6'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR27qE6', wd=4, mask=IN_MODIFY, cookie=0, name=b'sedR27qE6'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/sedR27qE6', wd=4, mask=IN_MOVED_FROM, cookie=400580, name=b'sedR27qE6'> [2021-07-08 20:29:20] test: in-event <InotifyEvent: src_path=b'/dir1/config/domain.cfg', wd=4, mask=IN_MOVED_TO, cookie=400580, name=b'domain.cfg'> [2021-07-08 20:29:25] test: Watch directory stabilized for 5 seconds. Triggering command. [2021-07-08 20:29:25] test: Command triggered, but it's too soon to run the command again. Waiting another 580 seconds

ok, but I ak not sure what that has solved... I was able to edit the file while doing the two DD commands and running the lsof in the loop. Vim barked duriong save because the file was updated during my edit period. I saved anyways and saw the one item show up in the while loop.... I never saw anything else with an open handle to that file....

So I do use a VM, so turning this off isnt really an option I want to try. I did try the LSOF loop as stated above and didnt see anything, but the write time of the domain.cfg file most certainly keeps changing . I am running 6.9.2