auid bug
Steve
m6x at ornl.gov
Mon Jul 24 16:04:51 UTC 2006
> Are you sure you have pam_loginuid.so configured in the appropriate
> /etc/pam.d/* files, such as login and sshd?
I checked the login file and it matches yours, I am not using ssh on
this machine.
> I'm running the .41 kernel and the audit-1.2.4 tools and
> the auid is correct in the audit records on my system.
Most of the time, mine is correct as well. It seems to occur
sporadically. Usually, a reboot will fix the problem.
Steve
>> I am receiving audit events with an odd auid... I am not sure if this
>> is something wrong in the kernel or in audit. The auid I am receiving
>> is 4294967295 (the max value for an unsigned long). The other uid/gid
>> information is normal.
>>
>> I have seen this on all audit versions since audit-1.2.3, and noticed it
>> using the following kernels:
>>
>> 2.6.17-1.2293.2.2_FC6.lspp.38.i686
>> 2.6.17-1.2293.2.2_FC6.lspp.44.i686
>>
>> The first time I noticed this was after the filter_key patch I applied
>> to audit-1.2.3, but it may have nothing to do with that patch. I
>> mentioned it then:
>>
>> https://www.redhat.com/archives/linux-audit/2006-June/msg00086.html
>>
>> There is an example record from the audit dispatcher there.
>>
>> These events are coming straight from the real-time audit dispatcher.
>>
>> Steve
More information about the Linux-audit
mailing list