[Patch]Fix the error in the output of "auditctl -s" when auditd is stoped

Chu Li chul at cn.fujitsu.com
Thu Aug 7 04:50:45 UTC 2008


Hi Steve,
  When auditd is stoped, "auditctl -s" will show "pid=0". I think it's not
correct information. It's better to tell users "auditd not started".

Signed-off-by: Chu Li <chul at cn.fujitsu.com>
---
diff --git a/src/auditctl.c b/src/auditctl.c
index 10894f9..b26dd82 100755
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -1411,12 +1411,15 @@ static int audit_print_reply(struct audit_reply *rep)
 			printed = 1;
 			return 0;
 		case AUDIT_GET:
-			printf("AUDIT_STATUS: enabled=%d flag=%d pid=%d"
-			" rate_limit=%d backlog_limit=%d lost=%d backlog=%u\n",
+			printf("AUDIT_STATUS: enabled=%d flag=%d"
+			" rate_limit=%d backlog_limit=%d lost=%d backlog=%u ",
 			rep->status->enabled, rep->status->failure,
-			rep->status->pid, rep->status->rate_limit,
-			rep->status->backlog_limit, rep->status->lost,
-			rep->status->backlog);
+			rep->status->rate_limit, rep->status->backlog_limit,
+			rep->status->lost, rep->status->backlog);
+			if(rep->status->pid != 0)
+				printf("pid=%d\n", rep->status->pid);
+			else
+				printf("auditd_not_started\n");
 			printed = 1;
 			return 0;
 		case AUDIT_LIST:

Regards
Chu Li






More information about the Linux-audit mailing list