Thanks for the report. This was noted by the RHEV folks in bug 1010472 and is reported as audit bug 1005202.

I'm reluctant to add an isatty() check to sos right now since the ausearch problem is not fully understood (ausearch hanging is not expected behaviour) so we risk losing potentially useful information on systems that may not even be affected if a fix is made to the ausearch tool.

I think the changes proposed in bug 1005703 will help this in the meantime however - by running all commands under the timeout program we'll at least exit cleanly once the timeout expires and return the rest of the report. Unfortunately that's not scheduled to land until 6.6.

For now the best option is probably to either disable the plugin or request a tty when running in an ssh session.

(In reply to Bryn M. Reeves from comment #2)
> Thanks for the report. This was noted by the RHEV folks in bug 1010472 and
> is reported as audit bug 1005202.
> 
> I'm reluctant to add an isatty() check to sos right now since the ausearch
> problem is not fully understood (ausearch hanging is not expected behaviour)
> so we risk losing potentially useful information on systems that may not
> even be affected if a fix is made to the ausearch tool.
> 
> I think the changes proposed in bug 1005703 will help this in the meantime
> however - by running all commands under the timeout program we'll at least
> exit cleanly once the timeout expires and return the rest of the report.
> Unfortunately that's not scheduled to land until 6.6.
> 
> For now the best option is probably to either disable the plugin or request
> a tty when running in an ssh session.

SSH is an example of a case where it is possible to request a TTY.  There are other use cases (e.g. calling SoS from Java) where it is not possible to request a TTY.  As such, it would be beneficial for the plug-in to detect this condition and execute everything except that command.

In that case you probably want to wait for either the timeout support or a fixed ausearch (and then depend on the package version of either sos or audit).

I had a quick look at the ausearch source code, and these are the results:

ausearch doesn't need a TTY, it alters behavior if the input is a pipe.  This is documented behavior, mentioned in the manpage:

    --input-logs
        Use  the log file location from auditd.conf as input for search‐
        ing. This is needed if you are using ausearch from a cron job.

Therefore, your issue should go away if you call ausearch with the --input-logs option.

Thanks Florian - this sounds like a much better option to allow TTYless sos runs to complete. I'll test this out here and get a fix upstream.

Looking at ausearch source this is certainly intended - --input-logs sets the force_logs global which changes the behaviour in aureport.c's main():

113         if (user_file)
114                 rc = process_file(user_file);
115         else if (force_logs)
116                 rc = process_logs(&config);
117         else if (is_pipe(0))
118                 rc = process_stdin();
119         else
120                 rc = process_logs(&config);

So the default behaviour when stdin is a pipe is to read a log file path from stdin and process that. Sure enough, sending '/some/path<EOF>' down the pipe causes ausearch to process that file and exit.

It seems confusing that although the option to turn this behaviour off is documented there is no mention of the fact that the audit tools are expecting a path on stdin in this situation.

I'll mention this in bug 1005202 to see if we can get the docs updated.

aureport/ausearch rather - both use the same logic.

I misread; the commands expect the log data rather than the file path on stdin - this is mentioned in the opening paragraph of the man pages for both so I think we can close bug 1005202 NOTABUG.

The audit tools are designed to be piped together. For example, you might do something like this:

ausearch --start today -k code-injection --raw | aureport --summary -x -i
ausearch --start today -m avc --raw | aureport --summary -x -i

So, if you need to force the search to the logs, use --imput-logs as mentioned previously.

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

commit cdb987afb42da238828fb49fdb539a4b9621f8ec
Author: Bryn M. Reeves <bmr>
Date:   Fri Jun 20 11:01:08 2014 +0100

    [selinux] pass --input-logs when calling ausearch
    
    If ausearch is run without a tty it expects log data to be fed on
    stdin. This causes the selinux plugin to appear to hang when run
    e.g. over an ssh session. Force the command to use the logs
    defined in auditd.conf by specifying --input-logs.
    
    Signed-off-by: Bryn M. Reeves <bmr>

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1528.html