Linux OS Logging (snoopy)

;;; REQUIRED Section [snoopy] ;;; Log Message Format ; Security-enriched format: covers identity, session, process tree, and command context ; message_format = "datetime=%{datetime} hostname=%{hostname} user=%{username} uid=%{uid} euser=%{eusername} euid=%{euid} login=%{login} tty=%{tty} tty_user=%{tty_username} sid=%{sid} pid=%{pid} ppid=%{ppid} cwd=%{cwd} filename=%{filename} cmdline=%{cmdline}" message_format = "user=%{username} %{datetime} cmdline=%{cmdline} loginuser=%{login} tty=%{tty}" ;;; Filter Chain ; Exclude high-noise system UIDs (0=root daemon activity, 1-999 = typical system accounts) ; Adjust UID ranges to match your system's service account allocation ; Keep only_tty if you want interactive-session-only logging (remove for full coverage) filter_chain = "exclude_spawns_of:cron,sshd,systemd;exclude_uid:1,2,3,4,5,6,7,8,9,10" ;;; Output output = file:/var/log/snoopy.log ;;; Error Logging ; Disable in production - enable only for troubleshooting error_logging = no ;;; Syslog settings (relevant if switching output to devlog/syslog) syslog_facility = LOG_AUTHPRIV syslog_ident = snoopy syslog_level = LOG_INFO

Additional Recommendations (outside this file)

• Add a logrotate entry for /var/log/snoopy.log with compress, dateext, and postrotate to avoid unbounded growth.
• If you’re forwarding to a SIEM, consider switching output to socket:/var/run/your-siem-socket.sock instead of file.
• Periodically audit the exclude_uid list against /etc/passwd as service accounts are added.

# /etc/logrotate.d/snoopy # # Logrotate configuration for Snoopy command-line logger # Place this file at: /etc/logrotate.d/snoopy # # Rotation strategy: # - Daily rotation with 90-day retention (adjust to meet your compliance requirements) # - Compressed archives to minimize disk usage # - Delayed compression to allow last-written log to remain readable # - Missing log is not an error (handles first-run and output gaps gracefully) /var/log/snoopy.log { # Rotate daily; change to 'weekly' or 'monthly' if volume is low daily # Keep 90 days of history; align with your audit retention policy (e.g. 365 for ISO 27001) rotate 90 # Compress rotated logs using gzip compress # Delay compression by one cycle — keeps yesterday's log uncompressed for easy access delaycompress # Do not error if log file is missing (e.g. snoopy not yet started) missingok # Do not rotate if log file is empty notifempty # Use date-based suffix instead of numeric (e.g. snoopy.log-20260217) dateext dateformat -%Y%m%d # Create new log file with strict permissions after rotation # Owner: root, Group: adm (change to syslog or your SIEM agent group if needed) create 0640 root adm # Rotate only this specific file, not any matching glob nosharedscripts postrotate # Signal rsyslog to reopen log files if you are also forwarding via syslog # Uncomment if rsyslog is in use: # /usr/bin/systemctl reload rsyslog > /dev/null 2>&1 || true # If you have a SIEM agent tailing the file, signal it here, for example for Filebeat: # /usr/bin/systemctl reload filebeat > /dev/null 2>&1 || true # Snoopy writes directly to file via LD_PRELOAD — no daemon to signal. # New file is created automatically by the 'create' directive above. /bin/true endscript # Optional: send alert if log exceeds 500MB before scheduled rotation # Uncomment and adjust threshold to suit your environment # size 500M }

logrotate -d /etc/logrotate.d/snoopy # dry run, shows what would happen logrotate -f /etc/logrotate.d/snoopy # force rotation now to verify it works