audit errors on FC4 shutdown

Claude Jones claude_jones at levitjames.com
Wed Jul 27 16:33:58 UTC 2005


First post here - hope someone knows what the following is about. When I 
shutdown or reboot, I'm getting the following messages: 

--------------------- Selinux Audit Begin ------------------------ 

 **Unmatched Entries** (Only first 10 out of 24 are printed)
  The audit daemon is exiting.
  audit: *NO* daemon at audit_pid=1920
  audit(1122429286.858:9676498): arch=40000003 syscall=102 success=no exit=-22 
a0=b a1=bf9e3470 a2=80510f8 a3=0 items=0 pid=29548 auid=4294967295 uid=0 
gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditctl" 
exe="/sbin/auditctl"
  audit(1122429286.858:9676498): saddr=100000000000000000000000
  audit(1122429286.858:9676498): nargs=6 a0=3 a1=bf9e55cc a2=10 a3=0 
a4=bf9e7768 a5=c
  audit(1122429286.959:9676518): SELinux:  unrecognized netlink message 
type=1009 for sclass=49
  audit(1122429286.959:9676518): arch=40000003 syscall=102 success=no exit=-22 
a0=b a1=bf9e3450 a2=80510f8 a3=0 items=0 pid=29548 auid=4294967295 uid=0 
gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditctl" 
exe="/sbin/auditctl"
  audit(1122429286.959:9676518): saddr=100000000000000000000000
  audit(1122429286.959:9676518): nargs=6 a0=3 a1=bf9e55ac a2=10 a3=0 
a4=bf9e7748 a5=c
  Init complete, auditd 0.9.15 listening for events

This is from my logs, but it looks just like this on my screen as the shutdown 
is occurring. I did some research on this and have gained a layman's 
understanding of netlink, but I couldn't figure out how to troubleshoot the 
problem. 
-- 
Claude Jones
Bluemont, VA, USA




More information about the fedora-selinux-list mailing list