COVESA / COVESA/dlt-daemon

Incorrect log level assignment for auditd messages without PRIORITY field

Open
#731 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
459
Forks
340
Avg merge
4d 21h
Merged PRs (30d)
2

Description

# Environment

- dlt-daemon: (v2.18.10: 0f2d4cfffada6f8448a2cb27995b38eb4271044f )
- systemd: 244.5
- audit: 2.8.5
- linux: 5.4

# Issue

Currently, dlt-daemon assigns the log level "Emergency" to all journal messages from auditd that lack a PRIORITY field.
This behavior originates from the current implementation of [get_journal_msg()](https://github.com/COVESA/dlt-daemon/blob/master/src/system/dlt-system-journal.c#L202-L256), which does not handle cases where the PRIORITY field is missing.

## Example message from auditd
```
Tue 2024-12-24 17:20:49.383000 UTC+9 [s=0272031534e84e679782433f87f4562a;i=56a;b=a5f717e39b1644779bbdff5c09e85249;m=fcc71;t=629ffca66ae5a;x=6093bf34f8a4fa5d]
_BOOT_ID=a5f717e39b1644779bbdff5c09e85249
_MACHINE_ID=076f208e43f94dab8f210263f82252d0
_HOSTNAME=mymachine
_UID=0
_TRANSPORT=audit
_AUDIT_TYPE=1130
SYSLOG_FACILITY=4
SYSLOG_IDENTIFIER=audit
_AUDIT_TYPE_NAME=SERVICE_START
_PID=1
_AUDIT_LOGINUID=4294967295
_AUDIT_SESSION=4294967295
_SELINUX_CONTEXT=system_u:system_r:init_t:s0
AUDIT_FIELD_COMM=systemd
AUDIT_FIELD_EXE=/lib/systemd/systemd
AUDIT_FIELD_HOSTNAME=?
AUDIT_FIELD_ADDR=?
AUDIT_FIELD_TERMINAL=?
AUDIT_FIELD_RES=success
_SOURCE_REALTIME_TIMESTAMP=1735028449383000
_AUDIT_ID=17
MESSAGE=SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-udevd comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
AUDIT_FIELD_UNIT=systemd-udevd
```

## Expected Behavior

Since messages from auditd with SYSLOG_FACILITY=4 do not contain a PRIORITY field, dlt-daemon should determine the appropriate log level based on other fields such as _AUDIT_TYPE.

## Possible Improvement

- Modify get_journal_msg() to:
- Check SYSLOG_FACILITY and _AUDIT_TYPE when PRIORITY is missing.
- Use a fallback mechanism to infer a more accurate log level rather than defaulting to "Emergency".
- e.g. If _AUDIT_TYPE is `AVC`, messages will be classified to "Error" and if not, messages will be classified to "INFO".

Would appreciate any thoughts or suggestions on how best to handle this!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.