My /var/log/audit/audit.log is filling up every five mins or so and rotating due to massive amounts of these mysql entries:

type=SYSCALL msg=audit(1399994296.816:65645): arch=c000003e syscall=144 success=no exit=-22 a0=1392 a1=0 a2=2ad70ed2c5c0 a3=0 items=0 ppid=4011 pid=5010 auid=4294967295 uid=27 gid=27 euid=27 suid=27 fsuid=27 egid=27 sgid=27 fsgid=27 tty=(none) ses=4294967295 comm="mysqld" exe="/usr/libexec/mysqld" subj=system_u:system_r:mysqld_t:s0 key=(null)

What rule can I add to /etc/audit/audit.rules so that I can exclude this item from being audited?

I tried adding these two rules, rebooting the server, has no effect:
-a exit,never -F path=/usr/libexec/mysqld
-a exit,never -F path=/usr/libexec/mysqld -F auid=4294967295




Robert

Rebooting the server isn't necessary. Exclusion rules should precede the rest of the rules. What is the rule that leads to this syscall logging?

tks. I got frustrated and rebuilt my audit.rules file.
Here is what it looks like and the mysql is still logging constantly!!!
==================================================================================================== ====================================

# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 1500

# Feel free to add below this line. See auditctl man page

#to prevent mysql from filing up the logs
-a exit,never -F path=/usr/libexec/mysqld

#GEN2720, 2720-2, 2720-3, 2720-4, 2720-5
-a exit,always -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM
-a exit,always -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES
#GEN2740
-a exit,always -F arch=b32 -S unlink
-a exit,always -F arch=b64 -S unlink
#GEN2740-2
-a exit,always -F arch=b32 -S rmdir
-a exit,always -F arch=b64 -S rmdir
#GEN2750
-w /usr/sbin/useradd -p x -k useradd
-w /usr/sbin/groupadd -p x -k groupadd
-w /etc/passwd -p a -k passwd
-w /etc/shadow -p a -k shadow
-w /etc/group -p a -k group
-w /etc/gshadow -p a -k gshadow
#GEN2751
-w /usr/sbin/usermod -p x -k usermod
-w /usr/sbin/groupmod -p x -k groupmod
-w /etc/passwd -p w -k passwd
-w /etc/shadow -p w -k shadow
-w /etc/group -p w -k group
-w /etc/gshadow -p w -k gshadow
#GEN2752
-w /usr/bin/passwd -p x -k passwd
#GEN2753
-w /usr/sbin/userdel -p x
-w /usr/sbin/groupdel -p x
#GEN2760-2
-w /etc/audit/audit.rules
#GEN2760, 2760-3, 2760-4, 2760-5, 2760-6
-a exit,always -F arch=b32 -S sched_setscheduler -S adjtimex -S settimeofday -S stime -S clock_settime
-a exit,always -F arch=b64 -S sched_setscheduler -S adjtimex -S settimeofday -S clock_settime
#GEN2760-7, 2760-8, 2760-9
-a exit,always -F arch=b32 -S sethostname -S setdomainname -S sched_setparam
-a exit,always -F arch=b64 -S sethostname -S setdomainname -S sched_setparam
#GEN2800
-w /var/log/faillog -p wa
-w /var/log/lastlog -p wa
#GEN2820, 2820-10, 2820-11, 2820-12, 2820-13
-a exit,always -F arch=b32 -S chmod -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr
-a exit,always -F arch=b64 -S chmod -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr
#GEN2820-2, 2820-3, 2820-4, 2820-5, 2820-6, 2820-7, 2820-8, 2820-9
-a exit,always -F arch=b32 -S fchmod -S fchmodat -S chown32 -S fchown32 -S fchownat -S lchown32 -S setxattr -S lsetxattr
-a exit,always -F arch=b64 -S fchmod -S fchmodat -S chown -S fchown -S fchownat -S lchown -S setxattr -S lsetxattr
#GEN2825, 2825-2
-a exit,always -F arch=b32 -S init_module -S delete_module
-a exit,always -F arch=b64 -S init_module -S delete_module
#GEN2825-3
-w /sbin/insmod -p x
#GEN2825-4
-w /sbin/modprobe -p x
#GEN2825-3
-w /sbin/rmmod -p x

#adding -e requires reboot to implement new rules
-e 2

I have narrowed it down to one line that is causing all of the mysql audits:

-a exit,always -F arch=b64 -S sched_setscheduler -S adjtimex -S settimeofday -S clock_settime

Found the answer on the redhat support site and in a couple mysql pages.

https://access.redhat.com/site/solutions/481993

I edited the /etc/my.cnf and added skip-thread-priority under the [mysqld] area. Restarted services. Fixed now.
==============================working /etc/my.cnf file======================================

[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
user=mysql
skip-thread-priority

old_passwords=1

[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid


Robert

1 members found this post helpful.