From mboxrd@z Thu Jan  1 00:00:00 1970
From: Miloslav Trmac <mitr@redhat.com>
Subject: Re: audit-viewer
Date: Mon, 2 Mar 2009 12:22:53 -0500 (EST)
Message-ID: <488168736.180571236014573827.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com>
References: <1241228806.180461236014459986.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1241228806.180461236014459986.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Dan Gruhn <Dan.Gruhn@groupw.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Hello,
----- "Dan Gruhn" <Dan.Gruhn@groupw.com> wrote:
> I am getting this error when audit viewer starts:
> 
> # audit-viewer
> Error reading audit events: No such file or directory.
> 
> Thinking that perhaps something is pointing to the wrong files, I 
> attempted to use Window/Change event source.. . Then I get this:
<snip>
>   File "/usr/local/share/audit-viewer/source_dialog.py", line 161, in
> 
> __source_log_with_rotated_toggled
>     self.source_log.set_active_iter(it)
> TypeError: iter should be a GtkTreeIter
This crash is a bug in audit-viewer, I'll fix it for the next release.

I'm not 100% sure, but I think the problem is caused by the fact that audit-viewer searches for audit logs in the --prefix subtree (as specified by configure). You can verify the used path by running (strings /your/prefix/libexec/audit-viewer-server-real |grep /log/audit); If it is not /var/log/audit, you'll need to rebuild audit-viewer, specifying --localstatedir=/var .

I'll document the necessity to use --localstatedir.

Thank you,
    Mirek