From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Wolff Felix (ETAS-SEC/ECT-Be)" Subject: AW: Error starting auditd Date: Thu, 16 May 2019 14:11:47 +0000 Message-ID: <349996a1e9564695a2a281c9396b4f80@escrypt.com> References: <3dc64aea26e94e68818b81289f1a713b@escrypt.com> <20190516135644.nt3l4l4xwmrkhizl@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <20190516135644.nt3l4l4xwmrkhizl@madcap2.tricolour.ca> Content-Language: de-DE List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Richard Guy Briggs Cc: "Linux-audit@redhat.com" List-Id: linux-audit@redhat.com Good hint, thanks! Running `dmesg | grep audit_pid` revealed the pid of the= already running process! -----Urspr=FCngliche Nachricht----- Von: Richard Guy Briggs = Gesendet: Donnerstag, 16. Mai 2019 15:57 An: Wolff Felix (ETAS-SEC/ECT-Be) Cc: Linux-audit@redhat.com Betreff: Re: Error starting auditd On 2019-05-16 10:47, Wolff Felix (ETAS-SEC/ECT-Be) wrote: > Hello, Hi Felix, > I am currently porting auditd to a new platform. When starting it using `= auditd -f`, I get the following error: > = > "Error setting audit daemon pid (File exists)" > = > It occurs during the call to `audit_set_pid(fd, getpid(), WAIT_YES);` in = auditd.c. If I understand correctly, this call registers auditd with the ke= rnel, is that correct? fd looks like a valid file descriptor, at least its = >0. Especially the "file exists" part confuses me. In which direction can I= investigate that error? It appears you already have a process/task that is registered with the kern= el for this purpose and it is still alive and healthy. On a normal system = I would say it is likely auditd that was started by the system. On yours, are you sure you haven't got a previous one already at least part= ly running? The line responsible in the kernel is here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/ke= rnel/audit.c#n1262 > Thank you and greets, > Felix - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, R= ed Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635