From: Stephen Quinney <squinney@inf.ed.ac.uk>
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com
Subject: Re: Daemon start problems
Date: Tue, 13 Dec 2011 11:50:43 +0000 [thread overview]
Message-ID: <20111213115042.GA13679@finlaggan.inf.ed.ac.uk> (raw)
In-Reply-To: <201111291120.35715.sgrubb@redhat.com>
On Tue, Nov 29, 2011 at 11:20:35AM -0500, Steve Grubb wrote:
> On Tuesday, November 22, 2011 05:52:32 AM Stephen Quinney wrote:
> > However, I'm struggling to debug why it is failing each time. All I get back from
> > the daemon is an exit code of 1, this seems to mean "generic or unspecified error",
> > and no useful error messages so I'm a bit stuck on what to do next.
> >
> > Any suggestions?
>
> Have you looked in syslog? Generally the audit daemon writes about any problem it runs
> into there.
>
I have finally tracked down what was going on here. The daemon only
fails to start at boot time when the action_mail_acct configuration
option is set. A look in the audit_config.c code reveals that the
email address is passed through the validate_email() function which
uses gethostbyname() to check the host. Although the network is up
before auditd starts, at that point in the boot sequence there are no
reachable DNS servers. This is due to a local configuration oddity
with the resolv.conf file. Moving auditd to later in the boot sequence
resolves the problem.
Stephen Quinney
--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.
prev parent reply other threads:[~2011-12-13 11:50 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-22 10:52 Daemon start problems Stephen Quinney
2011-11-29 16:20 ` Steve Grubb
2011-12-13 11:50 ` Stephen Quinney [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111213115042.GA13679@finlaggan.inf.ed.ac.uk \
--to=squinney@inf.ed.ac.uk \
--cc=linux-audit@redhat.com \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox