[prev in list] [next in list] [prev in thread] [next in thread]
List: linux-audit
Subject: Re: Duplicate audit event IDs
From: Steve Grubb <sgrubb () redhat ! com>
Date: 2006-04-06 15:06:02
Message-ID: 200604061106.02733.sgrubb () redhat ! com
[Download RAW message or body]
On Thursday 06 April 2006 10:47, Steve Brueckner wrote:
> What might cause this?
The event ID can be recycled. Its the combination of time stamp and serial
number that creates uniqueness.
> At some point my event IDs got reset (they didn't cycle that fast!). I've
> been playing quite a bit with the audit system so I'm not sure what caused
> it. Possibilities include:
>
> - Restarting the auditd service
Nope
> - Rebooting the machine
Yep
> - Deleting the /var/log/audit/audit.log file
Nope
There can also be wrapping.
> Or should this just plain not happen?
It can happen.
> I'm on FC4 using kernel 2.6.12-1.1447_FC4xen0. I'm afraid I can't easily
> upgrade at the moment because I've build an entire system predicated on old
> versions of SELinux and Xen.
You will likely have other problems on a kernel that old. I think 2.6.14 was
when we really had most features in place and stable.
> I also have a couple of other questions:
>
> - How large to audit event numbers get before they cycle back to zero?
I think its a u32 number.
> - Is there any way to have ausearch only the most recent audit log instead
> of all logs?
Sure, use the "-if" option and give it the full path to the file.
ausearch -if /var/log/audit/audit.log
-Steve
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic