Re: [Patch]Fix the error in the output of "auditctl -s" when auditd is stoped
On Thu, 2008-08-07 at 12:50 +0800, Chu Li wrote:
Hi Steve,
When auditd is stoped, "auditctl -s" will show "pid=0". I think
it's not
correct information. It's better to tell users "auditd not started".
We do try to keep the whole key=value pair thing in audit records. I'd
be willing to go with something like -1 to make it really clear, but
with the number of complaints about the inconsistencies of audit records
from people like John Dennis I'm not sure I'm a fan of this patch....
-Eric
Signed-off-by: Chu Li <chul(a)cn.fujitsu.com>
---
diff --git a/src/auditctl.c b/src/auditctl.c
index 10894f9..b26dd82 100755
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -1411,12 +1411,15 @@ static int audit_print_reply(struct audit_reply *rep)
printed = 1;
return 0;
case AUDIT_GET:
- printf("AUDIT_STATUS: enabled=%d flag=%d pid=%d"
- " rate_limit=%d backlog_limit=%d lost=%d backlog=%u\n",
+ printf("AUDIT_STATUS: enabled=%d flag=%d"
+ " rate_limit=%d backlog_limit=%d lost=%d backlog=%u ",
rep->status->enabled, rep->status->failure,
- rep->status->pid, rep->status->rate_limit,
- rep->status->backlog_limit, rep->status->lost,
- rep->status->backlog);
+ rep->status->rate_limit, rep->status->backlog_limit,
+ rep->status->lost, rep->status->backlog);
+ if(rep->status->pid != 0)
+ printf("pid=%d\n", rep->status->pid);
+ else
+ printf("auditd_not_started\n");
printed = 1;
return 0;
case AUDIT_LIST:
Regards
Chu Li
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit