audit messages on shutdown -- Netlink socket error

Claude Jones claude_jones at levitjames.com
Sat Jul 23 12:46:27 UTC 2005


On Fri July 22 2005 11:19 pm, Claude Jones wrote:
> When I shutdown/reboot I get a string of audit messages - these are long
> rows of cryptic messages which pass by too quickly to be able to read - one
> part of a line reads "unrecognized netlink message type" - there are
> probably 10-12 rows of this and then the shutdown continues. There are no
> other indications of trouble. Can someone give me an idea of where to look
> for the cause of this? I've been reading the audid man page, and looked at
> ausearch, but I couldn't figured out how to use it since I don't really
> know what to look for.

Replying to me, I now add  this: in looking at my log for yesterday I find 
this entry:
-------------------- Selinux Audit Begin ------------------------ 

 **Unmatched Entries** 
  audit: initializing netlink socket (disabled)
  audit(1122028142.652:1): initialized 
 ---------------------- Selinux Audit End -------------------------

My netlink.h file, with commented sections removed looks like this:

struct sockaddr_nl
{
	sa_family_t	nl_family;	/* AF_NETLINK	*/
	unsigned short	nl_pad;		/* zero		*/
	__u32		nl_pid;		/* process pid	*/
       	__u32		nl_groups;	/* multicast groups mask */
};

struct nlmsghdr
{
	__u32		nlmsg_len;	/* Length of message including header */
	__u16		nlmsg_type;	/* Message content */
	__u16		nlmsg_flags;	/* Additional flags */
	__u32		nlmsg_seq;	/* Sequence number */
	__u32		nlmsg_pid;	/* Sending process PID */
};

/* Flags values */


/* Modifiers to GET request */


/*
   4.4BSD ADD		NLM_F_CREATE|NLM_F_EXCL
   4.4BSD CHANGE	NLM_F_REPLACE

   True CHANGE		NLM_F_CREATE|NLM_F_REPLACE
   Append		NLM_F_CREATE
   Check		NLM_F_EXCL
 */


struct nlmsgerr
{
	int		error;
	struct nlmsghdr msg;
};

That fourth line looks suspicious, and is highlighted in a different color 
when I look that the file in Konqueror, but I'm not sure what is the cause of 
"unsigned short" and what I should do about it --- Can anyone help? 
-- 
Claude Jones
Bluemont, VA, USA




More information about the fedora-list mailing list