- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
Hi,
Is there any way to make the *auditd system to log the SIGXCPU signal*?
As of now , without writing any specific rules, SIGSEGV is getting
logged. In my log I found lines as below :
/
type=ANOM_ABEND msg=audit(1383644379.989:88): auid=1000 uid=1000
gid=1000 ses=5 pid=2688 comm="chrome" reason="memory violation"
sig=11/
Attachments:
- attachment.html (text/html — 582 bytes)
On Tuesday, November 05, 2013 06:39:04 PM Paul Davies C wrote:
Hi,
Is there any way to make the *auditd system to log the SIGXCPU signal*?
As of now , without writing any specific rules, SIGSEGV is getting
logged. In my log I found lines as below :
/
type=ANOM_ABEND msg=audit(1383644379.989:88): auid=1000 uid=1000
gid=1000 ses=5 pid=2688 comm="chrome" reason="memory violation"
sig=11/
The ABnormal END event is triggered by any event that would be terminated by
the kernel with a core dump. Looking at the signal(7) man page, SIGXCPU by
default would core. So, it should trigger an event. I don't have a test case
to prove it, though.
Steve
In the man page it is written that *core dump on SIGXCPU **can fail* .
That is probably the reason why it is not logged.
On Tuesday, November 05, 2013 07:16:21 PM Paul Davies C wrote:
In the man page it is written that *core dump on SIGXCPU **can fail*
.
That is probably the reason why it is not logged.
I think we would want the event even if the core dump failed. Maybe the hook
placement needs review? Its probably been 5 years since it was put in the
kernel...that's a lot of time for things to change.
-Steve
Audit system do logs the core dump signals. It was a misunderstanding
from my part that lead me to believe that audit does not log SIGXCPU.
Sorry for the confusion.
4059
days inactive
4065
days old
linux-audit@lists.linux-audit.osci.io
4 comments
2 participants
tags (0)
participants (2)
-
Paul Davies C -
Steve Grubb