audit-viewer error

audit-viewer error

[LC Bruzenak]

My audit-viewer (audit-viewer-0.3-1) crashes at startup with the
following:

Traceback (most recent call last):
  File "/usr/share/audit-viewer/main.py", line 71, in <module>
    if w.setup_initial_window(args):
  File "/usr/share/audit-viewer/main_window.py", line 158, in
setup_initial_window
    self.new_list_tab([])
  File "/usr/share/audit-viewer/main_window.py", line 176, in
new_list_tab
    tab = ListTab(filters, self)
  File "/usr/share/audit-viewer/list_tab.py", line 161, in __init__
    self.refresh()
  File "/usr/share/audit-viewer/list_tab.py", line 195, in refresh
    event_sequence = self.__refresh_get_event_sequence()
  File "/usr/share/audit-viewer/list_tab.py", line 483, in
__refresh_get_event_sequence
    want_other_fields, True)
  File "/usr/share/audit-viewer/main_window.py", line 265, in
read_events
    keep_raw_records)
  File "/usr/share/audit-viewer/event_source.py", line 135, in
read_events
    e = events[(ts.serial, ts.sec, ts.milli)]
AttributeError: 'NoneType' object has no attribute 'serial'

I looked back through all the event IDs from today (I assume
ts.serial==auid) and didn't see any missing yet. 

I did see some ordering inconsistency (probably normal) - from "ausearch
-ts today -i" (note the second event set - the time and auid are not
consecutive as with the others). Surrounding events concatenated for
brevity:
----
type=PATH msg=audit(08/13/2008 10:35:11.661:2406) : item=1...
type=PATH msg=audit(08/13/2008 10:35:11.661:2406) : item=0...
type=CWD msg=audit(08/13/2008 10:35:11.661:2406) :  cwd=/ 
type=SYSCALL msg=audit(08/13/2008 10:35:11.661:2406) : ...
----
type=SYSCALL msg=audit(08/13/2008 09:47:47.411:1015) : arch=x86_64
syscall=read success=no exit=-4(Interrupted system call) a0=3
a1=7f0807344010 a2=21000 a3=3597f67a58 items=0 ppid=1 pid=5239
auid=lenny uid=lenny gid=lenny euid=lenny suid=lenny fsuid=lenny
egid=lenny sgid=lenny fsgid=lenny tty=(none) ses=2 comm=gvfs-fuse-daemo
exe=/usr/libexec/gvfs-fuse-daemon
subj=user_u:user_r:user_t:s0-s15:c0.c1023 key=(null) 
----
type=PATH msg=audit(08/13/2008 10:35:11.663:2407) : item=0...
type=CWD msg=audit(08/13/2008 10:35:11.663:2407) :  cwd=/ 
type=SYSCALL msg=audit(08/13/2008 10:35:11.663:2407) : arch=x86_64...
----

Any thoughts as to what I can do? 
I guess I can selectively move audit.log files out of the directory
until I can see which one has data causing the problem...

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: audit-viewer error

[Miloslav Trmač]

Hello,
LC Bruzenak píše v St 13. 08. 2008 v 14:10 -0500:
> My audit-viewer (audit-viewer-0.3-1) crashes at startup with the
> following:
<SNIP>
>   File "/usr/share/audit-viewer/event_source.py", line 135, in
> read_events
>     e = events[(ts.serial, ts.sec, ts.milli)]
> AttributeError: 'NoneType' object has no attribute 'serial'
I'd guess a line in the audit log is malformed, or auparse cannot parse
a valid line.

> I did see some ordering inconsistency (probably normal) - from "ausearch
> -ts today -i" (note the second event set - the time and auid are not
> consecutive as with the others). Surrounding events concatenated for
> brevity:
The way I understand the code, record order should not be relevant.

> Any thoughts as to what I can do? 
> I guess I can selectively move audit.log files out of the directory
> until I can see which one has data causing the problem...
That part's easy - the file the "Change event source" dialog shows.  

Finding the relevant line might be more work, the simplest brute-force
solution would probably be a binary search (discarding half of the lines
contained in the log file at a time to figure out which half contains
the malformed line).  If the data is not confidential, you can also just
send it to me and I'll try to reproduce the problem.
	Mirek