From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: explanation/translation of auditd exit codes Date: Wed, 1 May 2013 16:45:20 -0400 (EDT) Message-ID: <1619055812.39091357.1367441120080.JavaMail.root@redhat.com> References: <3021693.HLtnhthvcE@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx3-phx2.redhat.com (mx01.colomx.prod.int.phx2.redhat.com [10.5.7.1]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id r41KjKTQ020931 for ; Wed, 1 May 2013 16:45:20 -0400 In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Peter Moody Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com ausearch -i at least translates them into their posix names.... checking out /usr/include/asm-generic/errno-base.h shows: #define EEXIST 17 /* File exists */ But if you use -i it will do it correctly across arches, etc... ----- Original Message ----- > > > Isn't that just the return code of the syscall in question? Meaning, you'd > need to look up the syscall in the relevant include file to see what -17 > meant. Maybe auparse already does this, I'm not sure. > On May 1, 2013 12:10 PM, "Vaughn, Chad M" < chad.m.vaughn@lmco.com > wrote: > > > All, > > Is there a listing somewhere that explains what various exit codes in auditd > are? > > For example, we are getting some exit=-17 entries in our logs, and we have > narrowed it down to an init script that tries to create a directory that > already exists. > So, we are pretty sure exit=-17 means that a directory already exits. > > It would be nice if we knew all codes and their translation, whether it be > exit=-2, exit=-22, exit=-6, or exit=-17 and so on. > > I have yet to find that explained anywhere. Any info would be greatly > appreciated and would help us fine tune our audit.rules file. > > Chad Vaughn > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit