Auditd plugin that forwards audit events to OMS Agent for Linux
Перейти к файлу
vijaynadella 506617a7f4
Merge pull request #117 from microsoft/vnadella/aggr
Event Aggr | Cherry config and UTs
2024-09-16 13:00:49 -05:00
.github/workflows Update codeql.yml workflow name 2024-02-13 11:16:21 -05:00
build Resolve cr comments 2024-03-29 13:41:39 -05:00
conf/outconf.d Add Fluent event output writer to integrate AUOMS with OneAgent (#43) 2020-03-27 16:50:37 -07:00
installer Cherry config and UTs 2024-09-12 11:07:33 -05:00
.gitignore Install ipxutils 2023-08-28 11:03:45 -04:00
AbstractEventWriter.cpp Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
AbstractEventWriter.h Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
AuditRules.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
AuditRules.h Add stdexcept to AuditRules.h 2023-08-28 16:24:19 -04:00
AuditRulesMonitor.cpp Cmdline Redaction rule changes (#77) 2021-05-21 12:56:55 -07:00
AuditRulesMonitor.h Fix backlog_wait_time check/update logic (#66) 2020-12-16 14:15:01 -08:00
AuditStatus.cpp Convert to new priority queue design 2020-04-08 13:15:21 -07:00
AuditStatus.h Convert to new priority queue design 2020-04-08 13:15:21 -07:00
CGroups.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
CGroups.h Fix IO:DiscardAll bug and cgroup limits 2020-11-16 16:42:26 -08:00
CMakeLists.txt Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
CPULimits.cpp Tweak cgroup logic 2020-09-08 11:21:30 -07:00
CPULimits.h Set cgroup defaults, add some audit multicast support 2020-09-01 12:11:41 -07:00
Cache.h Fix RawEventAccumulator (#48) 2020-06-24 15:05:04 -07:00
CmdlineRedactor.cpp Add support for Mariner and bug fixes (#81) 2021-07-28 12:17:46 -07:00
CmdlineRedactor.h Add support for Mariner and bug fixes (#81) 2021-07-28 12:17:46 -07:00
CmdlineRedactorTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
CollectionMonitor.cpp Remove active check in auditd install validation 2024-05-21 08:29:18 -05:00
CollectionMonitor.h Add support from sysv and upstart 2024-03-29 10:45:04 -05:00
Config.cpp Add Cmdline Redaction support (#71) 2021-02-11 07:59:35 -08:00
Config.h Tweak event prioritization logic and defaults 2020-08-27 15:21:38 -07:00
ConfigTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
Defer.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Event.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
Event.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
EventAggregator.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
EventAggregator.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
EventAggregatorTests.cpp Cherry config and UTs 2024-09-12 11:07:33 -05:00
EventFilter.cpp Fix proc filter (#74) 2021-04-01 16:19:33 -07:00
EventFilter.h Patched so outputs can be added and removed and ProcessTree and GLobalFiltersMask are updated each time (#40) 2020-01-07 11:42:41 -08:00
EventId.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
EventMatcher.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
EventMatcher.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
EventMatcherTests.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
EventPrioritizer.cpp Cmdline Redaction rule changes (#77) 2021-05-21 12:56:55 -07:00
EventPrioritizer.h Tweak event prioritization logic and defaults 2020-08-27 15:21:38 -07:00
EventProcessorTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
EventQueue.h Fix IO:DiscardAll bug and cgroup limits 2020-11-16 16:42:26 -08:00
EventTests.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
EventWriterConfig.cpp Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
EventWriterConfig.h Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
ExecUtil.cpp Cleanup compile warnings (#97) 2022-07-20 12:42:18 -07:00
ExecUtil.h Convert to new priority queue design 2020-04-08 13:15:21 -07:00
ExecveConverter.cpp Add missing copyright headers 2020-08-24 14:22:29 -07:00
ExecveConverter.h Add missing copyright headers 2020-08-24 14:22:29 -07:00
ExecveConverterTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
FieldType.h Add missing copyright headers 2020-08-24 14:22:29 -07:00
FileUtils.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
FileUtils.h Add Cmdline Redaction support (#71) 2021-02-11 07:59:35 -08:00
FileWatcher.cpp Add missing copyright headers 2020-08-24 14:22:29 -07:00
FileWatcher.h Add missing copyright headers 2020-08-24 14:22:29 -07:00
FiltersEngine.cpp Fix ProcessTree data race issues (#75) 2021-04-19 08:51:25 -07:00
FiltersEngine.h Patched so outputs can be added and removed and ProcessTree and GLobalFiltersMask are updated each time (#40) 2020-01-07 11:42:41 -08:00
FluentEventWriter.cpp Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
FluentEventWriter.h Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
FluentEventWriterTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
Gate.h Set cgroup defaults, add some audit multicast support 2020-09-01 12:11:41 -07:00
IEventFilter.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
IEventReader.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
IEventWriter.h Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
IO.cpp Fix IO:DiscardAll bug and cgroup limits 2020-11-16 16:42:26 -08:00
IO.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Input.cpp Fix signal handling, silence spurious error (#67) 2020-12-16 14:15:47 -08:00
Input.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
InputBuffer.h Fix IO:DiscardAll bug and cgroup limits 2020-11-16 16:42:26 -08:00
Inputs.cpp Merge remaining release_2.1 branch bug fixes (#45) 2020-06-19 12:11:31 -07:00
Inputs.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Interpret.cpp Reference for linux/ipx.h 2023-08-28 16:00:14 -04:00
Interpret.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
KernelInfo.cpp Set cgroup defaults, add some audit multicast support 2020-09-01 12:11:41 -07:00
KernelInfo.h Set cgroup defaults, add some audit multicast support 2020-09-01 12:11:41 -07:00
LICENSE Initial code commit 2016-11-18 12:02:01 -08:00
LockFile.cpp Cleanup compile warnings (#97) 2022-07-20 12:42:18 -07:00
LockFile.h Trigger queue reset on upgrade 2020-05-22 10:39:27 -07:00
Logger.cpp Cleanup compile warnings (#97) 2022-07-20 12:42:18 -07:00
Logger.h Add log metrics (#65) 2021-02-11 08:17:46 -08:00
MachineType.h Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
Metrics.cpp Cleanup compile warnings (#97) 2022-07-20 12:42:18 -07:00
Metrics.h Add log metrics (#65) 2021-02-11 08:17:46 -08:00
Netlink.cpp Set cgroup defaults, add some audit multicast support 2020-09-01 12:11:41 -07:00
Netlink.h Set cgroup defaults, add some audit multicast support 2020-09-01 12:11:41 -07:00
NetlinkAudit.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
OMSEventWriter.cpp Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
OMSEventWriter.h Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
OMSEventWriterTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
OperationalStatus.cpp Cleanup compile warnings (#97) 2022-07-20 12:42:18 -07:00
OperationalStatus.h Cmdline Redaction rule changes (#77) 2021-05-21 12:56:55 -07:00
OperationalStatusTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
Output.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
Output.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
OutputInputTests.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
Outputs.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
Outputs.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
PriorityQueue.cpp Fix IO:DiscardAll bug and cgroup limits 2020-11-16 16:42:26 -08:00
PriorityQueue.h Fix IO:DiscardAll bug and cgroup limits 2020-11-16 16:42:26 -08:00
PriorityQueueTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
ProcFilter.cpp Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
ProcFilter.h Add Cmdline Redaction support (#71) 2021-02-11 07:59:35 -08:00
ProcMetrics.cpp Tweak mem limits logic 2020-08-25 11:23:05 -07:00
ProcMetrics.h Tweak mem limits logic 2020-08-25 11:23:05 -07:00
ProcessDefines.h Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
ProcessInfo.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
ProcessInfo.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
ProcessTree.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
ProcessTree.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
ProcessTreeTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
Queue.cpp Fix Queue and Event Parse bugs 2020-04-29 12:05:24 -07:00
Queue.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
QueueTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
README.md Update README.md 2019-08-07 07:42:05 -07:00
RawEventAccumulator.cpp Include USER_CMD redaction (#80) 2021-06-14 15:52:25 -07:00
RawEventAccumulator.h Fix IO:DiscardAll bug and cgroup limits 2020-11-16 16:42:26 -08:00
RawEventProcessor.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
RawEventProcessor.h Include USER_CMD redaction (#80) 2021-06-14 15:52:25 -07:00
RawEventReader.h Merge remaining release_2.1 branch bug fixes (#45) 2020-06-19 12:11:31 -07:00
RawEventRecord.cpp Cleanup compile warnings (#97) 2022-07-20 12:42:18 -07:00
RawEventRecord.h Fix audit record parsing (#72) 2021-03-29 15:20:18 -07:00
RawEventWriter.h Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
RecordType.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
Retry.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RunBase.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RunBase.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
SECURITY.md Microsoft mandatory file (#100) 2022-09-30 12:11:31 -07:00
SPSCDataQueue.cpp Fix bugs in SPSCDataQueue and PriorityQueue 2020-08-26 12:30:18 -07:00
SPSCDataQueue.h Add IO metrics, bug fixes 2020-08-24 10:10:32 -07:00
SPSCDataQueueTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
SchedPriority.cpp Add CPULimits and fixes 2020-06-10 13:09:59 -07:00
SchedPriority.h Add CPULimits and fixes 2020-06-10 13:09:59 -07:00
Signals.cpp Improve rule parsing, fix bugs (#28) 2019-05-09 13:34:17 -07:00
Signals.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
StdinReader.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
StdinReader.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
StdoutWriter.h Added support for receiver ack to control cursor 2017-09-29 16:25:45 -07:00
StringTable.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
StringTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
StringUtils.cpp Cmdline Redaction rule changes (#77) 2021-05-21 12:56:55 -07:00
StringUtils.h Cmdline Redaction rule changes (#77) 2021-05-21 12:56:55 -07:00
SyscallMetrics.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
SyscallMetrics.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
SyslogEventWriter.cpp Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
SyslogEventWriter.h Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
SystemMetrics.cpp Add IO metrics, bug fixes 2020-08-24 10:10:32 -07:00
SystemMetrics.h Add IO metrics, bug fixes 2020-08-24 10:10:32 -07:00
THIRD_PARTY_IP_NOTICE Rework plugin to support multi-home configuration 2017-05-22 04:13:32 -07:00
TempDir.cpp Eliminate compiler warnings minor build tweak. (#33) 2019-07-25 14:16:49 -07:00
TempDir.h Initial code commit 2016-11-18 12:02:01 -08:00
TempFile.cpp Eliminate compiler warnings minor build tweak. (#33) 2019-07-25 14:16:49 -07:00
TempFile.h Initial code commit 2016-11-18 12:02:01 -08:00
TestEventData.cpp Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
TestEventData.h Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
TestEventQueue.h Fix IO:DiscardAll bug and cgroup limits 2020-11-16 16:42:26 -08:00
TestEventWriter.h Made output format code changes (#87) 2021-10-19 15:14:56 -07:00
Translate.h Tweak event prioritization logic and defaults 2020-08-27 15:21:38 -07:00
TranslateArch.cpp Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
TranslateErrno.cpp Improve rule parsing, fix bugs (#28) 2019-05-09 13:34:17 -07:00
TranslateField.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
TranslateFieldType.cpp Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
TranslateRecordType.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
TranslateSyscall.cpp Add runtime_error class reference 2023-08-25 11:45:44 -04:00
UnixDomainListener.cpp Add support for abstract UDS addresses (#90) 2021-11-17 13:24:57 -08:00
UnixDomainListener.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
UnixDomainWriter.cpp Add support for abstract UDS addresses (#90) 2021-11-17 13:24:57 -08:00
UnixDomainWriter.h Added support for receiver ack to control cursor 2017-09-29 16:25:45 -07:00
UserDB.cpp Revert file perm changes 2024-03-28 07:05:26 -05:00
UserDB.h Improve rule parsing, fix bugs (#28) 2019-05-09 13:34:17 -07:00
UserDBTests.cpp Build refactor (#94) 2022-04-08 10:58:18 -07:00
Version.cpp Add missing copyright headers 2020-08-24 14:22:29 -07:00
Version.h Add missing copyright headers 2020-08-24 14:22:29 -07:00
auoms.cpp Revert file perm changes 2024-03-28 07:05:26 -05:00
auoms.version Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
auomscollect.cpp Add event aggregation, fix ftrace usage (#103) 2022-11-10 14:18:56 -08:00
auomsctl.cpp Add support for Mariner and bug fixes (#81) 2021-07-28 12:17:46 -07:00
fakeaudispd.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
file2sock.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
testreceiver.cpp Fix ack queue deadlock 2020-06-11 17:11:11 -07:00

README.md

OMS-Auditd-Plugin

Auditd plugin that forwards audit events to OMS Agent for Linux

Build Instructions

Env Setup

git clone https://github.com/Microsoft/pal
git clone https://github.com/microsoft/OMS-Auditd-Plugin
cd OMS-Auditd-Plugin
ROOT=$(pwd)

Build Docker images

cd build/docker
docker build -t auoms-build auoms-build
docker build -t auoms-build32 auoms-build32
cd $ROOT

Build 64bit auoms

build/run-docker-build.sh

Build 32bit auoms

build/run-docker-build.sh 32