search

SUSE / linux-security-sensor

Linux security sensor
Other
18 stars 9 forks source link

Add SUSE.Linux.Events.Timers artifact #83

Closed xTeixeira closed 5 months ago

xTeixeira commented 8 months ago

This artifact collects systemd timer executions.

I'm using systemctl list-timers with json output in order to get a list of services that are activated by timers, since we need to watch for the actual services in order to get information like Pid, Cmd and output (Line). Let me know if there are any easier/better ways to do this.

There is one limitation: This doesn't appear to work for transient timers (e.g. running systemd-run --on-active=30s somecommand), but I couldn't find any way to make it work for these cases.

xTeixeira commented 7 months ago

Added an artifact for logging started/stopped timers

xTeixeira commented 7 months ago

TimerExecs works on a dummy timer I created. But it does not detect when the snapper timers run.

I rewrote the artifact and based it on SUSE.Linux.Events.Services (#71)

This way it should work for almost everything (I believe it still won't work for transient timers).