explanation/translation of auditd exit codes

[Eric Paris]

ausearch -i at least translates them into their posix names....

checking out /usr/include/asm-generic/errno-base.h shows:

#define EEXIST          17      /* File exists */

But if you use -i it will do it correctly across arches, etc...

----- Original Message -----
> 
> 
> Isn't that just the return code of the syscall in question? Meaning, you'd
> need to look up the syscall in the relevant include file to see what -17
> meant. Maybe auparse already does this, I'm not sure.
> On May 1, 2013 12:10 PM, "Vaughn, Chad M" < chad.m.vaughn at lmco.com > wrote:
> 
> 
> All,
> 
> Is there a listing somewhere that explains what various exit codes in auditd
> are?
> 
> For example, we are getting some exit=-17 entries in our logs, and we have
> narrowed it down to an init script that tries to create a directory that
> already exists.
> So, we are pretty sure exit=-17 means that a directory already exits.
> 
> It would be nice if we knew all codes and their translation, whether it be
> exit=-2, exit=-22, exit=-6, or exit=-17 and so on.
> 
> I have yet to find that explained anywhere. Any info would be greatly
> appreciated and would help us fine tune our audit.rules file.
> 
> Chad Vaughn
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit