From the package to the first event in ninho

Five steps, each one with its expected result. If a step does not return what is written here, stop on it: the next one will fail in silence.

audit 3.x

x86_64 · aarch64

Install the package

Two dependencies only, each with a declared reason in the repository.

shell

# for rhel and derivatives
sudo dnf localinstall -y https://rpm.rda.run/repo.rpm
sudo dnf install -y corvo

# for debian / ubuntu and derivatives
wget https://apt.rda.run/pool/main/apt-rda-run_1.0.0_all.deb
sudo dpkg -i apt-rda-run_1.0.0_all.deb
sudo apt update
sudo apt install corvo

Endpoint and token

The token lives in a file, with mode 0600. check warns if it is looser than that.

/etc/corvo/corvo.yml

endpoint:
  url: https://ninho.example.com/api/ingest
  token_file: /etc/corvo/token
  gzip: true
queue:
  dir: /var/lib/corvo/queue
  max_bytes: 512MiB
  full_policy: drop_oldest

Run check before anything else

A nonzero exit means it slots straight into Ansible, or any pipeline that already watches exit codes.

root@srv-web-01 · corvo check

$ corvo check
  okconfig/etc/corvo/corvo.yml
  okendpoint200 in 41 ms · https://ninho.example.com/api/ingest
  oktoken/etc/corvo/token · 0600
  okqueue0 pending event(s) · 1 segment(s)
All good.

Rules and plugin registration

On AlmaLinux the directory is /etc/audit/plugins.d/, not the /etc/audisp/ of RHEL 7 and 8.

exec rule and auditd restart

echo '-a always,exit -F arch=b64 -S execve -k cmds' \
  | sudo tee /etc/audit/rules.d/50-cmds.rules
sudo augenrules --load
sudo systemctl restart auditd

expected: auditctl -l lists the rule with the cmds key

Confirm it in ninho

Run any command on the audited machine and look for the host on the agents screen.

shell

id -u
curl -s -H "Authorization: Bearer $NINHO_READ_TOKEN" https://ninho.example.com/api/agents \
  | jq '.[] | select(.host=="srv-web-01")'

expected: {"host":"srv-web-01","silence_seconds":4,"events_total":1841}

From here on, the queue is your thermometer

Watch corvo_queue_depth_bytes and the silence per host. A growing queue points at the endpoint. Long silence on an active machine points at the agent.

auditd → https · nothing gets lost corvo (Portuguese for raven) is the agent, ninho (nest) is the server. Both speak the same versioned contract.

docs how it works corvo (agent) ninho (server)

ninho docs tutorials how-to guides reference explanation

corvo docs tutorials how-to guides reference explanation

reference API contract install metrics and queue

code git.rda.run/corvo/corvo git.rda.run/corvo/ninho MIT license