2018-09-07 11:30:09 UTC
I'm working on a custom audispd plugin written in Python 3. Itâs a work in
progress and Iâve successfully run it numerous times as an audispd plugin.
However, I sometimes make modifications that result in the audispd plugin
failing and I end up with the following in /var/log/syslog
Sep 6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3
Sep 6 20:52:05 ubuntu-hypervisor audispd: plugin /usr/bin/python3 was
This is repeated several times until audispd gives up and I see the
Sep 6 20:52:14 ubuntu-hypervisor audispd: plugin /usr/bin/python3 has
To troubleshoot, I modify my code to read from /var/log/audit/audit.log
instead. I modify a single line (with fileinput.input() to read from
myfile as shown in the commented line below).
Here is the code snippet (a colorized easier to read version is available
here - https://pastebin.com/84Nxu3Rp):
# let us initialize the AuParser
aup = auparse.AuParser(auparse.AUSOURCE_FEED)
# we initalize the callback to be fn_process_event
aup.add_callback(fn_process_event, None, None)
myfile = "/var/log/audit/audit.log"
# we read in line by line from stdin
for line in fileinput.input():
#for line in fileinput.input(myfile):
logger.error("Fatal error in while loop", exc_info=True)
# we flush the feed when we quit
Any suggestions on how to troubleshoot these types of issues when reading
from a file works fine without issue but running it as a plugin fails as
shown in /var/log/syslog? Thanks.