From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: [PATCH] Handle timestamp 0.0 in auparse, was Re: audit-viewer help needed Date: Mon, 22 Sep 2008 20:04:43 -0500 Message-ID: <1222131883.6513.92.camel@homeserver> References: <1221782548.6783.30.camel@homeserver> <1221812917.2947.10.camel@amilo> <1221830658.6513.4.camel@homeserver> <1222126221.2685.81.camel@amilo> <1222130317.6513.85.camel@homeserver> <1222131479.2685.92.camel@amilo> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1222131479.2685.92.camel@amilo> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Miloslav =?UTF-8?Q?Trma=C4=8D?= Cc: linux-audit List-Id: linux-audit@redhat.com On Tue, 2008-09-23 at 02:57 +0200, Miloslav Trma=C4=8D wrote: > LC Bruzenak p=C3=AD=C5=A1e v Po 22. 09. 2008 v 19:38 -0500: > > On Mon, 2008-09-22 at 23:30 +0000, Miloslav Trma=C4=8D wrote: ... >=20 > I think I can see what's going on. Those are kernel threads; when they > are created, an audit context is created and zeroed. The timestamp is > set on system call entry in ordinary threads, but there is no system > call entry in kernel threads, so the original zero timestamp is used in > all audit records related to kernel threads. >=20 > I'm not sure how to fix it, though. Perhaps identify "operation start" > points in kernel threads, and update the timestamps in their audit > contexts at that time? > Mirek >=20 OK; excellent summary! The bad thing IMO is that ausearch doesn't show these records. It just drops them (and exits with exit value =3D 1). LCB. --=20 LC (Lenny) Bruzenak lenny@magitekltd.com