Re: How to identify failed syscalls
On Friday, October 25, 2013 06:26:20 AM Leam Hall wrote:
Running aureport gives me a lot of failed syscalls. How do I
identify
what syscalls are failing and what is calling them?
Aureport's purpose is to give summary information. Ausearch gives detailed
information. To get what syscalls are failing, you can just run the "--syscall
--summary" report. To se what is calling them is a bit trickier. You can
isolate the events with ausearch and then pipe them to aureport for
summarizing:
ausearch --start today -m syscall -sv no --raw | aureport -x --summary
If you need to seethe individual events, then
ausearch --start today -m syscall -sv no -i
-Steve