Re: Hundreds of null PATH records for *init_module syscall audit logs
On Tuesday, March 7, 2017 11:00:27 AM EST Richard Guy Briggs wrote:
On 2017-03-07 10:41, Steven Rostedt wrote:
> On Mon, 6 Mar 2017 22:39:54 -0500
>
> Richard Guy Briggs <rgb(a)redhat.com> wrote:
> > >From the output I've seen, it doesn't look particularly useful, but
it
> >
> > was useful to finally see the source of those huge numbers of PATH
> >
> > records. Here's an fpaste:
> > https://paste.fedoraproject.org/paste/
UpZoYuokojR0es1ayNdx5l5M1UNdIGYhy
> > RLivL9gydE=/>
> Those are the files for the module's trace events that are created.
>
> I'm still confused about what the issue is.
The issue is the audit subsystem being overwhelmed by potentially
useless information.
The initial report was "there's a bunch of null PATH records, please
make them go away", which was anywhere from 500 to 6000 records.
Once I found out what they generally were and a way to enumerate the
contents, we're reviewing that assessment to see if they really should
be tossed, or listed out in full.
They should be tossed. They do not help in any way. What we need for an
auxiliary record is simply the module's name. That's all.
-Steve