explanation/translation of auditd exit codes

[Vaughn, Chad M]

Thanks to everybody for their help.

Eric, 

That file, /usr/include/asm-generic/errno-base.h, was exactly what I was looking for. Thanks!

Chad Vaughn

-----Original Message-----
From: Eric Paris [mailto:eparis at redhat.com] 
Sent: Wednesday, May 01, 2013 3:45 PM
To: Peter Moody
Cc: Vaughn, Chad M; linux-audit at redhat.com
Subject: EXTERNAL: Re: explanation/translation of auditd exit codes

ausearch -i at least translates them into their posix names....

checking out /usr/include/asm-generic/errno-base.h shows:

#define EEXIST          17      /* File exists */

But if you use -i it will do it correctly across arches, etc...

----- Original Message -----
> 
> 
> Isn't that just the return code of the syscall in question? Meaning, 
> you'd need to look up the syscall in the relevant include file to see 
> what -17 meant. Maybe auparse already does this, I'm not sure.
> On May 1, 2013 12:10 PM, "Vaughn, Chad M" < chad.m.vaughn at lmco.com > wrote:
> 
> 
> All,
> 
> Is there a listing somewhere that explains what various exit codes in 
> auditd are?
> 
> For example, we are getting some exit=-17 entries in our logs, and we 
> have narrowed it down to an init script that tries to create a 
> directory that already exists.
> So, we are pretty sure exit=-17 means that a directory already exits.
> 
> It would be nice if we knew all codes and their translation, whether 
> it be exit=-2, exit=-22, exit=-6, or exit=-17 and so on.
> 
> I have yet to find that explained anywhere. Any info would be greatly 
> appreciated and would help us fine tune our audit.rules file.
> 
> Chad Vaughn
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit