Re: operation not supported on filtering

source to find this. I don't think I can help much past this point as I'm not familiar with the Debian kernels. Thanks for the confirmation you helped me a lot On Tue, Dec 4, 2018 at 11:09 AM Steve Grubb <sgrubb(a)redhat.com&gt; wrote: > > On Tuesday, December 4, 2018 10:15:47 AM EST Vincent Fiset wrote: > > > strace /sbin/auditctl -a always,exclude -F msgtype=CWD > log 2>&1 > > > > Unfortunately I already tried that before, strace was not revealing > > anything obvious (for me at least) > > There's info in there. > > > sendto(4, > > "\34\3\0\0\353\3\5\0\2\0\0\0\0\0\0\0\5\0\0\0\2\0\0\0\1\0\0\0\377\377\377\3 > > 77"..., 796, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 796 > > poll([{fd=4, events=POLLIN}], 1, 500) = 1 ([{fd=4, revents=POLLIN}]) > > recvfrom(4, > > "0\3\0\0\2\0\0\0\2\0\0\0\355h\0\0\241\377\377\377\34\3\0\0\353\3\5\0\2\0\0 > > \0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, > > groups=00000000}, [12]) = 816 > > recvfrom(4, > > "0\3\0\0\2\0\0\0\2\0\0\0\355h\0\0\241\377\377\377\34\3\0\0\353\3\5\0\2\0\0 > > \0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, > > This ^^^ is the part to interpret: > > 0\3\0\0\ - length > 2\0 - msg type NLMSG_ERROR > \0\0 - flags > \2\0\0\0 - seq number > \355h\0\0\0 - pid > \241\377\377\377 - errno EOPNOTSUPP > > source to find this. I don't think I can help much past this point as I'm not > familiar with the Debian kernels. > > -Steve > > -- /VF