audit-viewer error

My audit-viewer (audit-viewer-0.3-1) crashes at startup with the following: Traceback (most recent call last): File "/usr/share/audit-viewer/main.py", line 71, in <module> if w.setup_initial_window(args): File "/usr/share/audit-viewer/main_window.py", line 158, in setup_initial_window self.new_list_tab([]) File "/usr/share/audit-viewer/main_window.py", line 176, in new_list_tab tab = ListTab(filters, self) File "/usr/share/audit-viewer/list_tab.py", line 161, in __init__ self.refresh() File "/usr/share/audit-viewer/list_tab.py", line 195, in refresh event_sequence = self.__refresh_get_event_sequence() File "/usr/share/audit-viewer/list_tab.py", line 483, in __refresh_get_event_sequence want_other_fields, True) File "/usr/share/audit-viewer/main_window.py", line 265, in read_events keep_raw_records) File "/usr/share/audit-viewer/event_source.py", line 135, in read_events e = events[(ts.serial, ts.sec, ts.milli)] AttributeError: 'NoneType' object has no attribute 'serial' I looked back through all the event IDs from today (I assume ts.serial==auid) and didn't see any missing yet. I did see some ordering inconsistency (probably normal) - from "ausearch -ts today -i" (note the second event set - the time and auid are not consecutive as with the others). Surrounding events concatenated for brevity: ---- type=PATH msg=audit(08/13/2008 10:35:11.661:2406) : item=1... type=PATH msg=audit(08/13/2008 10:35:11.661:2406) : item=0... type=CWD msg=audit(08/13/2008 10:35:11.661:2406) : cwd=/ type=SYSCALL msg=audit(08/13/2008 10:35:11.661:2406) : ... ---- type=SYSCALL msg=audit(08/13/2008 09:47:47.411:1015) : arch=x86_64 syscall=read success=no exit=-4(Interrupted system call) a0=3 a1=7f0807344010 a2=21000 a3=3597f67a58 items=0 ppid=1 pid=5239 auid=lenny uid=lenny gid=lenny euid=lenny suid=lenny fsuid=lenny egid=lenny sgid=lenny fsgid=lenny tty=(none) ses=2 comm=gvfs-fuse-daemo exe=/usr/libexec/gvfs-fuse-daemon subj=user_u:user_r:user_t:s0-s15:c0.c1023 key=(null) ---- type=PATH msg=audit(08/13/2008 10:35:11.663:2407) : item=0... type=CWD msg=audit(08/13/2008 10:35:11.663:2407) : cwd=/ type=SYSCALL msg=audit(08/13/2008 10:35:11.663:2407) : arch=x86_64... ---- Any thoughts as to what I can do? I guess I can selectively move audit.log files out of the directory until I can see which one has data causing the problem... Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com