explanation/translation of auditd exit codes

[Peter Moody]

Isn't that just the return code of the syscall in question? Meaning, you'd
need to look up the syscall in the relevant include file to see what -17
meant. Maybe auparse already does this, I'm not sure.
On May 1, 2013 12:10 PM, "Vaughn, Chad M" <chad.m.vaughn at lmco.com> wrote:

> All,
>
> Is there a listing somewhere that explains what various exit codes in
> auditd are?
>
> For example, we are getting some exit=-17 entries in our logs, and we have
> narrowed it down to an init script that tries to create a directory that
> already exists.
> So,  we are pretty sure exit=-17 means that a directory already exits.
>
> It would be nice if we knew all codes and their translation, whether it be
> exit=-2, exit=-22, exit=-6, or exit=-17 and so on.
>
> I have yet to find that explained anywhere. Any info would be greatly
> appreciated and would help us fine tune our audit.rules file.
>
> Chad Vaughn
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20130501/061b9d0a/attachment.htm>