Hi all: I found a bug the process auvrt generate a coredump when there is no file named audit.log, In the case the /var/log/audit/audit.log removed by someone. I make a patch to solve this problem. Index: auparse/auparse.c =================================================================== --- auparse/auparse.c (版本 814) +++ auparse/auparse.c (工作副本) @@ -806,7 +806,7 @@ case AUSOURCE_FILE: case AUSOURCE_FILE_ARRAY: // if the first time through, open file - if (au->list_idx == 0 && au->in == NULL) { + if (au->list_idx == 0 && au->in == NULL && au->source_list != NULL) { if (au->source_list[au->list_idx] == NULL) { errno = 0; return -2; [clq@localhost trunk]# auvirt Unable to open /var/log/audit/audit.log (No such file or directory) No log file Segmentation fault (core dumped) The backtrace is as follows: Loaded symbols for /lib64/ld-linux-x86-64.so.2 Core was generated by `./tools/auvirt/.libs/lt-auvirt'. Program terminated with signal 11, Segmentation fault. #0 0x00007fb2cc547b24 in retrieve_next_line (au=0x682830) at auparse.c:810 810 if (au->source_list[au->list_idx] == NULL) { Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.107.el6.x86_64 (gdb) bt #0 0x00007fb2cc547b24 in retrieve_next_line (au=0x682830) at auparse.c:810 #1 auparse_next_event (au=0x682830) at auparse.c:958 #2 0x00007fb2cc547c52 in auparse_first_record (au=<value optimized out>) at auparse.c:1131 #3 0x00007fb2cc547d77 in ausearch_next_event (au=0x682830) at auparse.c:923 #4 0x00000000004043b8 in main (argc=<value optimized out>, argv=<value optimized out>) at auvirt.c:1542 (gdb) f 0 #0 0x00007fb2cc547b24 in retrieve_next_line (au=0x682830) at auparse.c:810 810 if (au->source_list[au->list_idx] == NULL) { (gdb) p *au $1 = {source = AUSOURCE_LOGS, source_list = 0x0, list_idx = 0, in = 0x0, line_number = 0, next_buf = 0x0, off = 0, cur_buf = 0x0, line_pushed = 0, le = {head = 0x0, cur = 0x0, cnt = 0, e = {sec = 0, milli = 0, serial = 0, host = 0x0}}, expr = 0x680c90, find_field = 0x0, search_where = AUSEARCH_STOP_EVENT, parse_state = EVENT_EMPTY, databuf = {flags = 0, alloc_size = 0, alloc_ptr = 0x0, offset = 0, len = 0, max_len = 0}, callback = 0, callback_user_data = 0x0, callback_user_data_destroy = 0} (gdb) p au->source_list $2 = (char **) 0x0 (gdb) Best Regards!