From: Mateusz Piotrowski <0mp@freebsd.org>
To: linux-audit@redhat.com
Cc: Konrad Witaszczyk <def@freebsd.org>
Subject: Re: The res field has a value of 1 instead of either success or fail
Date: Wed, 20 Jul 2016 11:25:19 +0200 [thread overview]
Message-ID: <68967373-F5EC-4790-B7F0-DFD35220B0A8@FreeBSD.org> (raw)
In-Reply-To: <1DCCD2B1-2986-49D0-A204-C9246F3E1F12@FreeBSD.org>
Hello,
> On 19 Jul 2016, at 12:28, Mateusz Piotrowski <0mp@freebsd.org> wrote:
>
> type=CONFIG_CHANGE msg=audit(1464013671.541:406): auid=1000 ses=7 op="add rule" key=(null) list=4 res=1
> As you can see, there is a res field which value is 1.
>
> Is it because my auditd is outdated? Is there a missing res field which is purely numeric (just like the fields called fp [3])?
>
> As Steve said in previous emails, it is possible and it might be fixed already. I’ll try to find out if I get similar logs with the latest auditd (2.6.5) on CentOS 6.8-i386 later.
I confirm that it is possible to generate a type=CONFIG_CHANGE record with a res=1 field on CentOS 6.8 with auditd v2.6.5.
Cheers
-m
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2016-07-20 9:25 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-19 10:28 The res field has a value of 1 instead of either success or fail Mateusz Piotrowski
2016-07-20 9:25 ` Mateusz Piotrowski [this message]
2016-07-20 13:17 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68967373-F5EC-4790-B7F0-DFD35220B0A8@FreeBSD.org \
--to=0mp@freebsd.org \
--cc=def@freebsd.org \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox