From: Steve Grubb <sgrubb@redhat.com>
To: "linux-audit@redhat.com" <linux-audit@redhat.com>,
Fabio Sbano <fsbano@yahoo.com>
Subject: Re: Auditd is not turning off the system on (RHEL7.+)
Date: Wed, 14 Oct 2020 14:20:53 -0400 [thread overview]
Message-ID: <3344292.iIbC2pHGDl@x2> (raw)
In-Reply-To: <1347666069.660171.1602699215591@mail.yahoo.com>
On Wednesday, October 14, 2020 2:13:35 PM EDT Fabio Sbano wrote:
> I'm using 7.x with latest update :-(
> Can i reopen the bug?
Sure. I think you'd probably want to add your AVC to give a hint.
-Steve
> ( I turned off selinux for the auditd to work the halt )
> Best Regards,Fabio Sbano
>
> Sent from Yahoo Mail on Android
>
> On Wed, Oct 14, 2020 at 2:12 PM, Steve Grubb<sgrubb@redhat.com> wrote:
> Hello,
> On Wednesday, October 14, 2020 12:51:44 PM EDT Fabio Sbano wrote:
> > My /etc/audit/auditd.conf is configured as below but it is not turning
> > off
> > the system
> >
> > ## This file controls the configuration of the audit daemon#
> > local_events = yeswrite_logs = yeslog_file =
> > /var/log/audit/audit.loglog_group = rootlog_format = RAWflush =
> > INCREMENTAL_ASYNCfreq = 50max_log_file = 8num_logs = 5priority_boost =
> > 4disp_qos = lossydispatcher = /sbin/audispdname_format = NONE##name =
> > mydomainmax_log_file_action = ROTATEspace_left = 75space_left_action =
> > SYSLOGverify_email = yesaction_mail_acct = rootadmin_space_left =
> > 50admin_space_left_action = haltdisk_full_action =
> > SUSPENDdisk_error_action = SUSPENDuse_libwrap = yes##tcp_listen_port =
> > 60tcp_listen_queue = 5tcp_max_per_addr = 1##tcp_client_ports =
> > 1024-65535tcp_client_max_idle = 0enable_krb5 = nokrb5_principal =
> > auditd##krb5_key_file = /etc/audit/audit.keydistribute_network = no
>
> I believe this bz is relevant:
> https://bugzilla.redhat.com/show_bug.cgi?id=1780332
>
> If you update to the 7.9 release, it should work like it is supposed to.
>
> Best Regards,
> -Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-10-14 18:21 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1025996531.618266.1602694304884.ref@mail.yahoo.com>
2020-10-14 16:51 ` Auditd is not turning off the system on (RHEL7.+) Fabio Sbano
2020-10-14 17:12 ` Steve Grubb
2020-10-14 18:13 ` Fabio Sbano
2020-10-14 18:20 ` Steve Grubb [this message]
2020-10-14 18:34 ` Fabio Sbano
2020-10-15 10:46 ` Fabio Sbano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3344292.iIbC2pHGDl@x2 \
--to=sgrubb@redhat.com \
--cc=fsbano@yahoo.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.