From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Davies C Subject: SIGXCPU and Auditd Date: Tue, 05 Nov 2013 18:39:04 +0530 Message-ID: <5278EDF0.3050804@gmail.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3692079714377912487==" Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id rA5D9ANi020331 for ; Tue, 5 Nov 2013 08:09:10 -0500 Received: from mail-pd0-f177.google.com (mail-pd0-f177.google.com [209.85.192.177]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rA5D99YE013813 for ; Tue, 5 Nov 2013 08:09:09 -0500 Received: by mail-pd0-f177.google.com with SMTP id p10so8351140pdj.36 for ; Tue, 05 Nov 2013 05:09:08 -0800 (PST) Received: from [192.168.2.2] ([117.204.117.211]) by mx.google.com with ESMTPSA id y9sm40385104pas.10.2013.11.05.05.09.06 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 05 Nov 2013 05:09:07 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============3692079714377912487== Content-Type: multipart/alternative; boundary="------------090705020109080802010701" This is a multi-part message in MIME format. --------------090705020109080802010701 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi, Is there any way to make the *auditd system to log the SIGXCPU signal*? As of now , without writing any specific rules, SIGSEGV is getting logged. In my log I found lines as below : / type=ANOM_ABEND msg=audit(1383644379.989:88): auid=1000 uid=1000 gid=1000 ses=5 pid=2688 comm="chrome" reason="memory violation" sig=11/ --------------090705020109080802010701 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Hi,

Is there any way to make the auditd system to log the SIGXCPU signal?
As of now , without writing any specific rules, SIGSEGV is getting logged. In my log I found lines as below :

type=ANOM_ABEND msg=audit(1383644379.989:88): auid=1000 uid=1000 gid=1000 ses=5 pid=2688 comm="chrome" reason="memory violation" sig=11

--------------090705020109080802010701-- --===============3692079714377912487== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3692079714377912487==--