Assuming i otherwise have eventing enabled, and can pull user_events and es_process_events and auditd is set up right… is there a reason socket_events might be completely unpopulated? (This is on macOS)

Do you have

--audit_allow_sockets

?

Yup!

What hardware specifically? x86? M1/M2? Bare metal or VM?

M1, physical

socket_events

should not depend on

process_events

. But I'm noticing this too

Interesting, do you lack an /etc/security/audit_control file?

Admittedly I'm less familiar with OpenBSM, I think you were mentioning earlier that you should've configured it via file I assume (and I guess you avoided to pass

--audit_allow_config

)?

Do you get anything with

pgrep auditd

?

yep

Ok, so you re enabled it at some point

I guess I should try on a VM too to avoid messing with my host, since indeed there something using it. But I did start with an audit_control that did not include the socket_events so it makes sense that without the flag, the pipe is not configured to get those events. Though in your case you have audit_control with everything enabled, but you do not pass that last flag correct?

Yeah

So, testing in the VM, the issue is that you need to restart the whole system if you change

audit_control

, otherwise

auditd

won't pick up the change.

Yeah as another data point, running with

--audit_allow_config

(and the various other flags) works for us to collect both

socket_events

and

es_process_events

. Just make sure to be on latest version with this fix https://github.com/osquery/osquery/issues/8076 otherwise there are sporadic crashes

Ok thank you :) will keep trying

You should be able to test with osqueryi:

sudo osqueryi --disable_audit=false --disable_events=false --disable_endpointsecurity=false --audit_allow_sockets=true --audit_allow_config=true

(I haven't looked into how to get things working without --audit_allow_config though)

My tests have been with

osqueryi

. events do work with the shell, it's just that expiration behaves slightly differently (and only looks at the value in the

events_expiry

flag). The link I provided above mentions that you can edit

audit_control

, but then you need to reboot yourself.

Yeah, i have a “I’m holding it wrong” problem here somewhere

What’s weird is

select * from osquery_events

shows there are thousands of openbsm events, and 22 subscriptions

I think this is a shortcoming/bug of the implementation. As far I can see the

process_events

table itself is always active, it's just that `audit_allow_process_events`controls the configuration only

Hmmm

but that's unrelated with the problem you're having

Oh, accessing the openbsm publisher