I am writing a parser for Linux Audit and I stumbled upon some weird cases which doesn't seem to comply with the standard.
My reference is the Red Hat's documentation.
A proper audit record should look like this:
type=USER_CMD msg=audit(1464013671.517:403): pid=3569 uid=0 auid=1000 ses=7 msg='cwd="/root" cmd=123 terminal=pts/1 res=success'
An invalid name=value field in a record
Let's look at the following record:
type=DAEMON_START msg=audit(1464013652.147:626): auditd start, ver=2.4 format=raw kernel=3.16.0-4-586 auid=4294967295 pid=3557 res=success
The documentation says nothing about auditd start
which doesn't fit the name=value format.
What is this? Where I can read about it?
A comma and a space as a separator
Additionally, the documentation says that
Each record consists of several name=value pairs separated by a white space or a comma.
It is clearly not true since we can see that auditd start, ver=2.4
are separated with a command and a space.
Why is it so? Where is the standard really described?
Additional whitespaces in a record
Let's look at the following record:
type=CWD msg=audit(1464013682.961:409): cwd="/root"
It has two spaces between type=CWD msg=audit(1464013682.961:409):
and cwd="/root"
. It doesn't make any sense. In fact, I observed this behaviour only in records with type=CWD
and cwd="/root"
.
Why is it so?
Note: I've generated those logs on a recent Debian.