From: Eric Paris <eparis@redhat.com>
To: Peter Moody <pmoody@google.com>
Cc: linux-audit@redhat.com
Subject: Re: explanation/translation of auditd exit codes
Date: Wed, 1 May 2013 16:45:20 -0400 (EDT) [thread overview]
Message-ID: <1619055812.39091357.1367441120080.JavaMail.root@redhat.com> (raw)
In-Reply-To: <CALnj_=6CU_xEBsiD97+LjJ7onno0Jfdv93YANRA3UjeiRSka8g@mail.gmail.com>
ausearch -i at least translates them into their posix names....
checking out /usr/include/asm-generic/errno-base.h shows:
#define EEXIST 17 /* File exists */
But if you use -i it will do it correctly across arches, etc...
----- Original Message -----
>
>
> Isn't that just the return code of the syscall in question? Meaning, you'd
> need to look up the syscall in the relevant include file to see what -17
> meant. Maybe auparse already does this, I'm not sure.
> On May 1, 2013 12:10 PM, "Vaughn, Chad M" < chad.m.vaughn@lmco.com > wrote:
>
>
> All,
>
> Is there a listing somewhere that explains what various exit codes in auditd
> are?
>
> For example, we are getting some exit=-17 entries in our logs, and we have
> narrowed it down to an init script that tries to create a directory that
> already exists.
> So, we are pretty sure exit=-17 means that a directory already exits.
>
> It would be nice if we knew all codes and their translation, whether it be
> exit=-2, exit=-22, exit=-6, or exit=-17 and so on.
>
> I have yet to find that explained anywhere. Any info would be greatly
> appreciated and would help us fine tune our audit.rules file.
>
> Chad Vaughn
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2013-05-01 20:45 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-01 14:29 audit 2.3 released Steve Grubb
2013-05-01 19:05 ` explanation/translation of auditd exit codes Vaughn, Chad M
2013-05-01 19:15 ` Peter Moody
2013-05-01 20:45 ` Eric Paris [this message]
2013-05-01 20:52 ` Vaughn, Chad M
2013-05-01 20:16 ` Smith, Gary R
2013-05-05 9:43 ` audit.rules file [Was: audit 2.3 released] Laurent Bigonville
2013-05-05 13:32 ` Burn Alting
2013-05-06 13:17 ` Steve Grubb
2013-05-06 14:02 ` Laurent Bigonville
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1619055812.39091357.1367441120080.JavaMail.root@redhat.com \
--to=eparis@redhat.com \
--cc=linux-audit@redhat.com \
--cc=pmoody@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox