Logs auditing and analysis system based on virtual monitor
Xiaowen Nie · Journal of Computer Applications · 2006
SNARE is an audit logging and analysis tool for the Linux operating system. However, it is also vulnerable. A new approach was designed to protect SNARE from being tampered. With the capability of virtual machine monitor, SNARE was ported on two virtual machines running over the Xen which was a virtual machine monitor. The SNARE patch for Linux and audit daemon, which were two principal components of SNARE, were separated into two virtual machines isolated strongly by Xen. The mechanism for sharing memory between virtual machines was provided by Xen. By the mechanism, SNARE patch for Linux running on one virtual machine records and transfers the audit logs into the audit daemon running on another virtual machine. Compared with the traditional SNARE, the new method makes it is more difficult to destroy or tamper the audit logs. Preliminary evaluation shows that the prototype is simple and efficient.