- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
Hi All,
I found a new word "per" in some of the records of my audit.log.
Any idea of why this happened and what it means ?
type=SYSCALL msg=audit(1571245536.351:43593): arch=c000003e syscall=3
*per=40000* success=yes exit=0 a0=5 a1=5 a2=556213b6d6bc a3=7f483b98bcc0
items=0 ppid=2653 pid=2655 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000
fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=3 comm="gdb"
exe="/usr/bin/gdb" key=(null)
Thank you :)
Thanks & Regards,
Ankitha Kundhuru
Attachments:
- attachment.html (text/html — 808 bytes)
On 2019-10-16 15:36, Ankitha Kundhuru wrote:
Hi All,
I found a new word "per" in some of the records of my audit.log.
Any idea of why this happened and what it means ?
This is a "swinging" field, which means that it only appears when it is
different from an expected value (zero usually expected).
That isn't new. It has been there since the very first audit commit,
commit b7b0074ca3c9fe22d07b97e42a99c8b27be6307f
Author: Andrew Morton <akpm(a)osdl.org>
AuthorDate: 2004-04-11 23:29:12 -0700
Light-weight Auditing Framework
From: Rik Faith <faith(a)redhat.com>
You may never have seen it before because it appears you now have a
personality other than PER_LINUX for this event. 32-bit binary on 64
bit? I assume your arch is x86 64 (LE)?
type=SYSCALL msg=audit(1571245536.351:43593): arch=c000003e
syscall=3
*per=40000* success=yes exit=0 a0=5 a1=5 a2=556213b6d6bc a3=7f483b98bcc0
items=0 ppid=2653 pid=2655 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000
fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=3 comm="gdb"
exe="/usr/bin/gdb" key=(null)
Thank you :)
Thanks & Regards,
Ankitha Kundhuru
- RGB
--
Richard Guy Briggs <rgb(a)redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
Hello,
On Wednesday, October 16, 2019 3:36:43 PM EDT Ankitha Kundhuru wrote:
I found a new word "per" in some of the records of my
audit.log.
Any idea of why this happened
The process personality is not normal.
and what it means ?
https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/
field-dictionary.csv#L176
You can use ausearch -i to decode it.
-Steve
type=SYSCALL msg=audit(1571245536.351:43593): arch=c000003e
syscall=3
*per=40000* success=yes exit=0 a0=5 a1=5 a2=556213b6d6bc a3=7f483b98bcc0
items=0 ppid=2653 pid=2655 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000
fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=3 comm="gdb"
exe="/usr/bin/gdb" key=(null)
Thank you :)
Thanks & Regards,
Ankitha Kundhuru
1842
days inactive
1842
days old
linux-audit@lists.linux-audit.osci.io
2 comments
3 participants
tags (0)
participants (3)
-
Ankitha Kundhuru -
Richard Guy Briggs -
Steve Grubb