LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Red Hat
User Name
Password
Red Hat This forum is for the discussion of Red Hat Linux.

Notices


Reply
  Search this Thread
Old 12-22-2008, 05:52 AM   #1
agostino84
LQ Newbie
 
Registered: Dec 2008
Posts: 6

Rep: Reputation: 0
Exclamation Problem with audit daemon?


Problem in /var/log/audit/audit.log.1.
I'm working with a workstation cluster where is mounted Red Hat Enterprise (with Gnome). After that I tried to install some software some problems appears in root session. For example I'm not able to download the updates and furthermore I'm not able to open the administration of the system by GUI. I tried to restart the system and the only problem that occurs is 'audit [failed]'. So I went to read this file /var/log/audit/audit.log.1 and appears this:


type=ANOM_ABEND msg=audit(1222174623.498:608): auid=4294967295 uid=0 gid=7 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 pid=7192 comm="ipp" sig=11
type=ANOM_ABEND msg=audit(1222174623.504:609): auid=4294967295 uid=0 gid=7 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 pid=7193 comm="ipp" sig=11

To restart auditd is useful? How could I do to resolve my problem?
 
Old 12-22-2008, 05:44 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,393
Blog Entries: 55

Rep: Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565
Quote:
Originally Posted by agostino84 View Post
Problem in /var/log/audit/audit.log.1
".1" is a rotated logfile. For current problems see "/var/log/audit/audit.log". If you want to see messages scroll by try 'tail -f /var/log/audit/audit.log'.


Quote:
Originally Posted by agostino84 View Post
I'm not able to download the updates
Please show exact error messages if any.


Quote:
Originally Posted by agostino84 View Post
I'm not able to open the administration of the system by GUI.
Same here: please show exact error messages if any.


Quote:
Originally Posted by agostino84 View Post
type=ANOM_ABEND msg=audit(1222174623.498:608): auid=4294967295 uid=0 gid=7 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 pid=7192 comm="ipp" sig=11
(..)
How could I do to resolve my problem?
Typical SE Linux policy warnings can be found by running 'grep AVC /var/log/audit/audit.log'. You can see what rules need to be adjusted in your local policy running it as 'grep AVC /var/log/audit/audit.log|audit2allow'.


Quote:
Originally Posted by agostino84 View Post
To restart auditd is useful?
No. Audtid only exists to log SE Linux AVC (Access Vector Cache) messages. For example if Auditd does not run the messages end up in /var/log/messages. In short: restarting Auditd does not change your policy nor does it "repair" or "fix" errors.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How can I read the audit time stamp? msg=audit(1213186256.105:20663) abefroman Linux - Software 3 04-21-2011 07:37 PM
Problem with X11 audit MRMadhav Fedora 1 11-04-2006 09:14 PM
Configuring the audit daemon of RHEL4 update 2 herrmag Linux - Security 0 05-08-2006 05:39 PM
what's audit daemon for? liyuefu Linux - General 2 06-23-2005 12:37 PM
Audit Daemon in RH 7.3 oulevon Linux - Security 1 08-06-2002 08:20 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Red Hat

All times are GMT -5. The time now is 03:31 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration