1

I'm trying to parse audit.log with rsyslog by using a bash script in order to transform the hex part of proctitle to ascii. However I do not get ressults: the file audit_ascii.log do not have lines with "proctitle" values. I tested the script and it is working fine so I guess the problem comes from my rsyslog.conf.

rsyslog.conf:

$InputFileName /var/log/audit/audit.log
$InputFileTag tag_auditd:
$InputFileStateFile log_audit
$InputFileSeverity info
$InputFileFacility local6
$InputRunFileMonitor

if $msg contains "msg=audit" then {
action(type="omprog" binary="/bin/bash /opt/bin/hex2ascii.sh" output="/var/log/audit/audit_ascii.log")

hex2ascii

    #!/bin/bash
    read log
    
    hasHex=$(echo $log | egrep "msg=audit" | egrep "type=PROCTITLE" | egrep -v '"' | wc -c)
    
    if [ ${hasHex} -gt 0 ];
    then
        part1=$(echo $log | cut -d"=" -f1-3)
    
        part2=$(echo $log | cut -d"=" -f4)
        part2=$(echo $part2 | xxd -r -p )
        echo $part1 >> /var/log/audit/verif.txt 
        #echo "${part1}=${part2}\n" >> /var/log/audit/audit_ascii.log
        log="${part1}=${part2}\n"
    #else
        #echo $log >> /var/log/audit/audit_ascii.log
            
    fi

2 Answers 2

0

Though several modules are built-in to rsyslog, some of them are not and need to be loaded before they can be used.

The imfile module you are using needs to be preceded by the line (in legacy syntax):

$ModLoad imfile

Similarly, the omprog module, if using the newer syntax, needs

module(load="omprog")

before it can be used in the if statement (which is missing a closing }). Look at the error messages you will get from rsyslogd -N 1.

1
  • The module is already present in the rsyslog.conf. In fact it is working only when it comes to execute the script and writing logs which are not composed of "proctitle". I wish the script worked for "proctitle" logs and it would be perfect if I just could modify the $log in the script and then rsysog could directly write it it to my output. For the moment, I can't get any result from the "output" of omprog
    – Oecophylla
    Aug 17, 2021 at 7:56
0

Just stop the flow after the script redirected the changed log to another file. Then I take the new file as another input in rsyslog. Best solution I found

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.