Duplicate audit event IDs
What might cause this? At some point my event IDs got reset (they didn't
cycle that fast!). I've been playing quite a bit with the audit system so
I'm not sure what caused it. Possibilities include:
- Restarting the auditd service
- Rebooting the machine
- Deleting the /var/log/audit/audit.log file
Or should this just plain not happen? I'm on FC4 using kernel
2.6.12-1.1447_FC4xen0. I'm afraid I can't easily upgrade at the moment
because I've build an entire system predicated on old versions of SELinux
and Xen.
I also have a couple of other questions:
- How large to audit event numbers get before they cycle back to zero?
- Is there any way to have ausearch only the most recent audit log instead
of all logs?
[root@localhost audit]# ausearch -a 8412
----
time->Wed Apr 5 14:57:12 2006
type=PATH msg=audit(1144263432.028:8412): item=0
name="/home/dev/.icons/crystalsvg/index.theme" flags=101 inode=1278228
dev=03:01 mode=040775 ouid=600 ogid=600 rdev=00:00
type=CWD msg=audit(1144263432.028:8412): cwd="/home/dev"
type=SYSCALL msg=audit(1144263432.028:8412): arch=40000003 syscall=5
success=no exit=-2 a0=832d8e8 a1=0 a2=1b6 a3=83630e8 items=1 pid=1226
auid=4294967295 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600
sgid=600 fsgid=600 comm="metacity" exe="/usr/bin/metacity"
----
time->Wed Apr 5 15:30:44 2006
type=PATH msg=audit(1144265444.562:8412): item=0
name="/home/dev/.Xauthority-c" flags=310 inode=1278085 dev=03:01
mode=040775 ouid=600 ogid=600 rdev=00:00
type=CWD msg=audit(1144265444.562:8412): cwd="/home/dev"
type=SYSCALL msg=audit(1144265444.562:8412): arch=40000003 syscall=5
success=yes exit=2 a0=bfae17d3 a1=c1 a2=180 a3=bfae1f10 items=1 pid=1573
auid=4294967295 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600
sgid=600 fsgid=600 comm="xauth" exe="/usr/X11R6/bin/xauth"
Thanks,
Steve Brueckner, ATC-NY