[Patch]Fix the error in the output of "auditctl -s" when auditd is stoped
Eric Paris
eparis at redhat.com
Thu Aug 7 13:39:37 UTC 2008
On Thu, 2008-08-07 at 12:50 +0800, Chu Li wrote:
> Hi Steve,
> When auditd is stoped, "auditctl -s" will show "pid=0". I think it's not
> correct information. It's better to tell users "auditd not started".
We do try to keep the whole key=value pair thing in audit records. I'd
be willing to go with something like -1 to make it really clear, but
with the number of complaints about the inconsistencies of audit records
from people like John Dennis I'm not sure I'm a fan of this patch....
-Eric
> Signed-off-by: Chu Li <chul at cn.fujitsu.com>
> ---
> diff --git a/src/auditctl.c b/src/auditctl.c
> index 10894f9..b26dd82 100755
> --- a/src/auditctl.c
> +++ b/src/auditctl.c
> @@ -1411,12 +1411,15 @@ static int audit_print_reply(struct audit_reply *rep)
> printed = 1;
> return 0;
> case AUDIT_GET:
> - printf("AUDIT_STATUS: enabled=%d flag=%d pid=%d"
> - " rate_limit=%d backlog_limit=%d lost=%d backlog=%u\n",
> + printf("AUDIT_STATUS: enabled=%d flag=%d"
> + " rate_limit=%d backlog_limit=%d lost=%d backlog=%u ",
> rep->status->enabled, rep->status->failure,
> - rep->status->pid, rep->status->rate_limit,
> - rep->status->backlog_limit, rep->status->lost,
> - rep->status->backlog);
> + rep->status->rate_limit, rep->status->backlog_limit,
> + rep->status->lost, rep->status->backlog);
> + if(rep->status->pid != 0)
> + printf("pid=%d\n", rep->status->pid);
> + else
> + printf("auditd_not_started\n");
> printed = 1;
> return 0;
> case AUDIT_LIST:
>
> Regards
> Chu Li
>
>
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
More information about the Linux-audit
mailing list