From mboxrd@z Thu Jan  1 00:00:00 1970
From: Alexander Viro <aviro@redhat.com>
Subject: Re: OBJ_PID records
Date: Thu, 27 Sep 2007 23:25:51 -0400
Message-ID: <20070928032551.GJ21685@devserv.devel.redhat.com>
References: <200709211506.56322.sgrubb@redhat.com>
	<1190918445.3591.29.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
In-Reply-To: <1190918445.3591.29.camel@localhost.localdomain>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Eric Paris <eparis@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Thu, Sep 27, 2007 at 02:40:45PM -0400, Eric Paris wrote:

> Interestingly on this machine the opid has ALWAYS been 1956 with
> obj=syslogd_t.  I don't however think there is anything special about
> syslog though as that wasn't the obj in the messages sgrubb was getting,
> although i do wonder if it was the same opid every time.....

Because the process in question is started from rc scripts and gets
the same PID on each boot on that box?  PID 1956 sounds plausible in
that respect...

Same question: which process it actually is?  I.e. what does
ps 1956
give on that box?