-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/21/2010 11:11 PM, Robert Nichols wrote: > Any ideas how I can track down what might be blocking the logging of > audit messages to /var/log/audit/audit.log? The last entry there > is at 12:56:16 today, which is just as the system was coming up after > a reboot (matches the timestamps for the never-used LOGIN entries in > /var/run/utmp). I do see these lines in /var/log/messages right > afterward: > > Apr 21 12:56:26 omega-3a kernel: type=1305 audit(1271872586.681:17143): > auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op="remove > rule" key=(null) list=4 res=0 readahead sets up auditing to watch all file opens on boot. This allows it to optimize it self on the next boot. At a certain point during the boot process readahead turns off the watch on open, and that is what you are seeing. > > Apr 21 12:56:26 omega-3a kernel: type=1305 audit(1271872586.681:17144): > audit_enabled=0 old=1 auid=4294967295 ses=4294967295 > subj=system_u:system_r:readahead_t:s0 res=1 > > Thereafter, there are "dbus: Can't send to audit system" messages. > > The auditd service shows as running. If I restart auditd, audit.log > shows "auditd normal halt" and "auditd start" messages, and after that > messages do get logged to audit.log. > > I have no clue what might be setting audit_enabled=0 in the kernel, > but that "remove rule" message just before makes me suspicious that > it's SElinux related. > Maybe, but I doubt it. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkvQMOQACgkQrlYvE4MpobPQJQCdFE5ORsFe1CDCuwj5/8yOXI3e 9DAAniFhkBHOyrXhuxJfjI62uucOMO2h =zDU+ -----END PGP SIGNATURE----- -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
