Re: audit-viewer error

["Miloslav Trmač" <mitr@redhat.com>]

Hello,
LC Bruzenak píše v St 13. 08. 2008 v 14:10 -0500:
> My audit-viewer (audit-viewer-0.3-1) crashes at startup with the
> following:
<SNIP>
>   File "/usr/share/audit-viewer/event_source.py", line 135, in
> read_events
>     e = events[(ts.serial, ts.sec, ts.milli)]
> AttributeError: 'NoneType' object has no attribute 'serial'
I'd guess a line in the audit log is malformed, or auparse cannot parse
a valid line.

> I did see some ordering inconsistency (probably normal) - from "ausearch
> -ts today -i" (note the second event set - the time and auid are not
> consecutive as with the others). Surrounding events concatenated for
> brevity:
The way I understand the code, record order should not be relevant.

> Any thoughts as to what I can do? 
> I guess I can selectively move audit.log files out of the directory
> until I can see which one has data causing the problem...
That part's easy - the file the "Change event source" dialog shows.  

Finding the relevant line might be more work, the simplest brute-force
solution would probably be a binary search (discarding half of the lines
contained in the log file at a time to figure out which half contains
the malformed line).  If the data is not confidential, you can also just
send it to me and I'll try to reproduce the problem.
	Mirek