Why is the IP Address Is Not Always Available in the Audit Logs

Answer

There is no guarantee or “promise” that a Remote IP address is associated with a process and therefore included in an audit record generated for that process. This behavior is inherent to the design of the sockets layer and has remained unchanged in recent releases of the Operating System.

• The Sockets layer sets the local and Remote IP address in the thread control block each time a Sockets API is called in that thread, replacing any previous values.
• When the close() API call occurs and the thread control block addresses match those of the closed socket, the IP address values are zeroed out in the control block.
• A thread may have access to hundreds of open sockets. Until one of those sockets is used again in a Sockets API call, no IP address value can be stored in the thread control block.

• If the remote address field is blank in an audit record, it means the last TCP-based socket operation performed before the audit record was created was a close(), which cleared the remote address.
• Blank fields are unfortunate but ultimately unavoidable due to the way socket operations manage IP address data.

• The socket layer audit record information is valuable, but it has limitations.
• A blank IP address does not indicate an error in auditing; it reflects the state of the thread at the time the audit record was generated.