5

We've long had a tag about Linux's audit framework, in addition to , which is about the concept of auditing in general. We now have an additional tag .

Is there any reason to keep and ? What is the best name for a tag about Linux's audit framework — linux-audit, linux-audit-framework, something else?

Should the general conceptual tag be renamed to to reduce confusion?

3

We have to remember that Linux Audit is not the only audit standard in the Unix & Linux world. There is a BSM standard as well which is mostly used in the *BSD systems.

Here's what I suggest (after applying Gilles' suggestions):

  • and should be used for general questions about auditing, like this one (Is there a tool for seeing audit events as they happen without writing them to the disk?).
  • Let's merge with which seems to be suitable for questions about the Linux Audit standard and framework. This would be a tag for questions on Linux Audit logs, auditd, auditctl, etc. We should try to add a tag related to the OS of the original poster since the versions of audit frameworks on different GNU/Linux distros tend to differ significantly.
  • Maybe in the future there will be the need to create a tag for the BSM auditing standard ( maybe?) but for the time being there are no questions about this very specific topic.

Apart from that there is a closely related tag which often refers to the files produced by auditing tools.

  • The tag auditd as currently used is specific to Linux's audit subsystem. Is that the same thing as “Linux Audit” or not? I don't understand the distinction you make between Linux's auditd and “Linux Audit” (except that of course the daemon is only one part of the audit subsystem, there are also parts in the kernel, auditctl, etc.) – Gilles 'SO- stop being evil' Aug 2 '16 at 12:09
  • @Gilles auditd is a daemon in the Linux Audit framework (apart from that there is an auditd daemon on BSD systems the implementation and the interface of which has little to do with its Linux counterpart). In fact, auditd is only a part of the audit-userspace that Linux Audit offers. I guess that people often use the auditd tag because there is no better tag. I am not sure if I answered your question though. – Mateusz Piotrowski Aug 2 '16 at 12:19
  • 1
    Your comment does answer my question. Yes, people have been using the auditd tag to cover the whole Linux Audit framework. And I don't think we need a tag specifically about the daemon — in fact if anything most questions are about configuring the kernel facility via auditctl and interpreting the logs, the daemon is just an intermediary. So we should merge auditd into linux-audit. – Gilles 'SO- stop being evil' Aug 2 '16 at 12:26
  • @Gilles I updated the proposal. – Mateusz Piotrowski Aug 2 '16 at 12:34
2

Given the differences between Linux, Solaris, AIX, and *BSD auditing, and barring any known direction by POSIX to create a common auditing standard, my knee-jerk reaction would be to create OS-specific tags for each. Given that it seems that all of the auditd questions are Linux-based, I see no reason not to merge it into linux-audit. The site's general philosophy on tags persuades me in this direction, to better identify questions and answers of particular interest.

I don't know if it'd be valuable to simplify auditing tags down to just a single "audit" and require that the associated OS also be tagged. It seems to me that most on-topic, answerable questions on the site would be based in a particular OS (or two). I would be persuaded in this direction based mainly on the small number of auditing-related questions.

  • Auditing on Linux doesn't necessarily mean using the Linux Audit framework. It depends what you're auditing. System calls aren't always the right level. So the concept tag really can't be used as half of a tool tag. – Gilles 'SO- stop being evil' Aug 3 '16 at 7:38
  • 1
    Moreover, even the Linux Audit tend to differ a little bit between GNU/Linux distros which can possible result in tags like debian-linux-audit, centos-linux-audit and so on. I don't think this is the right approach especially that there seem to be only around 100 questions on auditing. Apart from that, the standard for *BSD and Solaris is BSM, although the implementation and available auditing tools might differ which makes the classification process even more cumbersome. – Mateusz Piotrowski Aug 3 '16 at 12:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .