auditd exchange protocol

Question

I'm currently working with auditd. It can be configured to send logs to a remote server using audispd.

But instead of running another auditd instance on a target machine I just want to write my own program to process incoming logs. And here is the problem.

Question
Where can I find the description of the protocol used to exchange data? Is there anything like that?

Answer 1

I understand that you are looking for more information regarding the log format, the transmission and that you are going ahead to write your own message multiplexer.

Looking into the man page of Linux Audit gave me the first hint about

format

The valid options for this are binary and string. Binary passes the data exactly as the audit event dispatcher gets it from the audit daemon. The string option tells the dispatcher to completely change the event into a string suitable for parsing with the audit parsing library. The default value is string.

So it seems that it is possible to use a binary or string (palin text) for log messages.

Further research took me to the mailing list and AUDISP_PROTOCOL_VER2, as well to Understanding Audit Log Files.

Additionaly writing a basic audispd plugin and How to send audit logs with audisp-remote and receive them with netcat will help you too.

I am aware that this might not fully answer your question, but it should give enough input to start.