camflow / camflowd Goto Github PK

In generated json file the attribute epoche is present:

I'm not sure if this is w3c compliant. If i try to validate one selected object from the generated log file with https://openprovenance.org/services/view/validator, it does not validate:

If i remove epoch attribute, validation is almost ok, except of some merge constraints:

Is it an expected behaviour? I did not find anything in relation to epoch configuration in the documentation.

After camflow installation and executing sudo camflow --track-file /bin/wget propagate and then wget www.google.de like on documentation page described, the provenance logfile starts to grow very fast. After disable the tracking on wget, log file continues to grow.

Gif above was made on Fedora 29 with

I tested this behaviour with all installation types:

1. Fedora-specific: using packagecloud (Fedora 27);
2. building the kernel on the local machine (Fedora 28, Fedora 29) ;
3. using vagrant to set up a virtual machine
   like described on this page.

Sometimes the logfile starts to grow even by just executing sudo camflow --track-file /bin/wget propagate without the actuall call on wget. This behaviour does not make any sense for me, because the object of interest was not even activ.

After activation of provenance capture with camflow --track-file propagate provenance is captured in e.g. audit.log file. After deactivation the log file size continues to grow. Even if i run camflow -e false to deactivate the whole provenance capture, the information is still logged. Is it possible to stop logging somehow?