operation not supported on filtering

[Vincent Fiset]

> So...your kernel is not supporting this. You'd need to dig through the kernel
source to find this. I don't think I can help much past this point as I'm not
familiar with the Debian kernels.

Thanks for the confirmation you helped me a lot
On Tue, Dec 4, 2018 at 11:09 AM Steve Grubb <sgrubb at redhat.com> wrote:
>
> On Tuesday, December 4, 2018 10:15:47 AM EST Vincent Fiset wrote:
> > > strace /sbin/auditctl -a always,exclude -F msgtype=CWD  >  log  2>&1
> >
> > Unfortunately I already tried that before, strace was not revealing
> > anything obvious (for me at least)
>
> There's info in there.
>
> > sendto(4,
> > "\34\3\0\0\353\3\5\0\2\0\0\0\0\0\0\0\5\0\0\0\2\0\0\0\1\0\0\0\377\377\377\3
> > 77"..., 796, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 796
> > poll([{fd=4, events=POLLIN}], 1, 500)   = 1 ([{fd=4, revents=POLLIN}])
> > recvfrom(4,
> > "0\3\0\0\2\0\0\0\2\0\0\0\355h\0\0\241\377\377\377\34\3\0\0\353\3\5\0\2\0\0
> > \0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0,
> > groups=00000000}, [12]) = 816
> > recvfrom(4,
> > "0\3\0\0\2\0\0\0\2\0\0\0\355h\0\0\241\377\377\377\34\3\0\0\353\3\5\0\2\0\0
> > \0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
>
> This ^^^ is the part to interpret:
>
> 0\3\0\0\ - length
> 2\0 - msg type NLMSG_ERROR
> \0\0 - flags
> \2\0\0\0 - seq number
> \355h\0\0\0 - pid
> \241\377\377\377 - errno EOPNOTSUPP
>
> So...your kernel is not supporting this. You'd need to dig through the kernel
> source to find this. I don't think I can help much past this point as I'm not
> familiar with the Debian kernels.
>
> -Steve
>
>


-- 
/VF