Re: explanation/translation of auditd exit codes

Peter Moody
2013-05-01T19:15:10Z

[-- Attachment #1.1: Type: text/plain, Size: 1018 bytes --]

Isn't that just the return code of the syscall in question? Meaning, you'd
need to look up the syscall in the relevant include file to see what -17
meant. Maybe auparse already does this, I'm not sure.
On May 1, 2013 12:10 PM, "Vaughn, Chad M" <chad.m.vaughn@lmco.com> wrote:

> All,
>
> Is there a listing somewhere that explains what various exit codes in
> auditd are?
>
> For example, we are getting some exit=-17 entries in our logs, and we have
> narrowed it down to an init script that tries to create a directory that
> already exists.
> So, we are pretty sure exit=-17 means that a directory already exits.
>
> It would be nice if we knew all codes and their translation, whether it be
> exit=-2, exit=-22, exit=-6, or exit=-17 and so on.
>
> I have yet to find that explained anywhere. Any info would be greatly
> appreciated and would help us fine tune our audit.rules file.
>
> Chad Vaughn
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>

[-- Attachment #1.2: Type: text/html, Size: 1452 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]