From mboxrd@z Thu Jan 1 00:00:00 1970 From: Brad Zynda Subject: Systemd Journald and audit logging causing journal issues Date: Mon, 2 Oct 2017 13:30:19 -0400 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mx1.redhat.com (ext-mx02.extmail.prod.ext.phx2.redhat.com [10.5.110.26]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2E10965E8E for ; Mon, 2 Oct 2017 17:28:53 +0000 (UTC) Received: from ndjsvnpf101.ndc.nasa.gov (NDJSVNPF101.ndc.nasa.gov [198.117.1.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 230B4820E1 for ; Mon, 2 Oct 2017 17:28:52 +0000 (UTC) Received: from ndmsppt202.ndc.nasa.gov (NDMSPPT202.ndc.nasa.gov [198.117.0.47]) by ndjsvnpf101.ndc.nasa.gov (Postfix) with ESMTP id 1ED904006E67 for ; Mon, 2 Oct 2017 12:28:51 -0500 (CDT) Received: from pps.filterd (ndmsppt202.ndc.nasa.gov [127.0.0.1]) by ndmsppt202.ndc.nasa.gov (8.16.0.21/8.16.0.21) with SMTP id v92HMppx052943 for ; Mon, 2 Oct 2017 12:28:50 -0500 Received: from ndmscht115.ndc.nasa.gov (ndmscht115-pub.ndc.nasa.gov [198.117.0.215]) by ndmsppt202.ndc.nasa.gov with ESMTP id 2dbnckj7wp-1 for ; Mon, 02 Oct 2017 12:28:50 -0500 Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com SGVsbG8gRXZlcnlvbmUsCgpJIGFtIHNlbmRpbmcgYWxvbmcgYW4gaXNzdWUgYnJvdWdodCB0byB0 aGUgc3lzdGVtZC1qb3VybmFsZCBkZXYgbGlzdAppbml0aWFsbHk6CgoKCk9uIDEwLzAyLzIwMTcg MTE6NDAgQU0sIExlbm5hcnQgUG9ldHRlcmluZyB3cm90ZToKPiBPbiBNbywgMDIuMTAuMTcgMTE6 MjUsIEJyYWQgWnluZGEgKGJyYWRsZXkudi56eW5kYUBuYXNhLmdvdikgd3JvdGU6Cj4KPj4gU2Vw IDI4IDEzOjUwOjAzIHNlcnZlciBzeXN0ZW1kLWpvdXJuYWxbNTY1XTogU3VwcHJlc3NlZCA3MzI0 NCBtZXNzYWdlcwo+PiBmcm9tIC9zeXN0ZW0uc2xpY2UvYXVkaXRkLnNlcnZpY2UKPgo+IFRoZSBx dWVzdGlvbiBpczogd2h5IGRvZXMgYXVkaXRkIGV2ZW4gbG9nIHRvIHRoZSBqb3VybmFsPwo+Cj4+ IE5vdyB3ZSBhcmUgcmVxdWlyZWQgdG8gaGF2ZSBmdWxsIGF1ZGl0IHJ1bGVzIGFuZCBkb2VzIHRo aXMgbG9vayBsaWtlIGF0Cj4+IHJhdGUgbGltaXRpbmcgaXNzdWUgb3IgYW4gaXNzdWUgb2Ygam91 cm5hbCBub3QgYWJsZSB0byBoYW5kbGUgdGhlCj4+IHRyYWZmaWMgdG8gbG9nZ2luZz8KPgo+IGpv dXJuYWxkIGRldGVjdGVkIHRoYXQgaXQgZ290IGZsb29kZWQgd2l0aCB0b28gbWFueSBtZXNzYWdl cyBpbiB0b28KPiBzaG9ydCBhIHRpbWUgZnJvbSBhdWRpdGQuIGlmIHRoaXMgaGFwcGVucyB0aGVu IHNvbWV0aGluZyBpcyBhbG1vc3QKPiBjZXJ0YWlubHkgb2ZmIHdpdGggYXVkaXRkLCBhcyBhdWRp dGQgaXMgbm90IHN1cHBvc2VkIHRvIGZsb29kIGpvdXJuYWxkCj4gd2l0aCBtZXNzYWdlcywgYWZ0 ZXIgYWxsIGl0IG1haW50YWlucyBpdHMgb3duIGF1ZGl0aW5nIGxvZyBkYXRhYmFzZS4KPgo+IFBs ZWFzZSBwaW5nIHRoZSBhdWRpdGQgZm9sa3MgZm9yIGhlbHAKPgo+IExlbm5hcnQKPgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzeXN0ZW1kLWRldmVsIG1h aWxpbmcgbGlzdApzeXN0ZW1kLWRldmVsQGxpc3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwczovL2xp c3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N5c3RlbWQtZGV2ZWwKCgoKCgpI ZXkgRXZlcnlvbmUsCgpOb3Qgc3VyZSBpZiB0aGlzIGlzIGEgYnVnIHNvOgoKc3lzdGVtY3RsIHN0 YXR1cyAtbCBzeXN0ZW1kLWpvdXJuYWxkLnNlcnZpY2UK4pePIHN5c3RlbWQtam91cm5hbGQuc2Vy dmljZSAtIEpvdXJuYWwgU2VydmljZQogICBMb2FkZWQ6IGxvYWRlZCAoL3Vzci9saWIvc3lzdGVt ZC9zeXN0ZW0vc3lzdGVtZC1qb3VybmFsZC5zZXJ2aWNlOwpzdGF0aWM7IHZlbmRvciBwcmVzZXQ6 IGRpc2FibGVkKQogICBBY3RpdmU6IGFjdGl2ZSAocnVubmluZykgc2luY2UgVHVlIDIwMTctMDkt MjYgMjA6MDE6MTYgVVRDOyA1IGRheXMgYWdvCiAgICAgRG9jczogbWFuOnN5c3RlbWQtam91cm5h bGQuc2VydmljZSg4KQogICAgICAgICAgIG1hbjpqb3VybmFsZC5jb25mKDUpCiBNYWluIFBJRDog NTY1IChzeXN0ZW1kLWpvdXJuYWwpCiAgIFN0YXR1czogIlByb2Nlc3NpbmcgcmVxdWVzdHMuLi4i CiAgIENHcm91cDogL3N5c3RlbS5zbGljZS9zeXN0ZW1kLWpvdXJuYWxkLnNlcnZpY2UKICAgICAg ICAgICDilJTilIA1NjUgL3Vzci9saWIvc3lzdGVtZC9zeXN0ZW1kLWpvdXJuYWxkCgpTZXAgMjgg MTM6NTA6MDMgc2VydmVyIHN5c3RlbWQtam91cm5hbFs1NjVdOiBTdXBwcmVzc2VkIDczMjQ0IG1l c3NhZ2VzCmZyb20gL3N5c3RlbS5zbGljZS9hdWRpdGQuc2VydmljZQpTZXAgMjggMTM6NTE6MDMg c2VydmVyIHN5c3RlbWQtam91cm5hbFs1NjVdOiBTdXBwcmVzc2VkIDk4OTc5IG1lc3NhZ2VzCmZy b20gL3N5c3RlbS5zbGljZS9hdWRpdGQuc2VydmljZQpTZXAgMjggMTM6NTI6MDMgc2VydmVyIHN5 c3RlbWQtam91cm5hbFs1NjVdOiBTdXBwcmVzc2VkIDEwOTQzMyBtZXNzYWdlcwpmcm9tIC9zeXN0 ZW0uc2xpY2UvYXVkaXRkLnNlcnZpY2UKU2VwIDI4IDEzOjUzOjAzIHNlcnZlciBzeXN0ZW1kLWpv dXJuYWxbNTY1XTogU3VwcHJlc3NlZCA5OTc4OCBtZXNzYWdlcwpmcm9tIC9zeXN0ZW0uc2xpY2Uv YXVkaXRkLnNlcnZpY2UKU2VwIDI4IDEzOjU0OjAzIHNlcnZlciBzeXN0ZW1kLWpvdXJuYWxbNTY1 XTogU3VwcHJlc3NlZCAxMTE2MDUgbWVzc2FnZXMKZnJvbSAvc3lzdGVtLnNsaWNlL2F1ZGl0ZC5z ZXJ2aWNlClNlcCAyOCAxMzo1NTowMyBzZXJ2ZXIgc3lzdGVtZC1qb3VybmFsWzU2NV06IFN1cHBy ZXNzZWQgMTExNTkxIG1lc3NhZ2VzCmZyb20gL3N5c3RlbS5zbGljZS9hdWRpdGQuc2VydmljZQpT ZXAgMjggMTM6NTY6MDMgc2VydmVyIHN5c3RlbWQtam91cm5hbFs1NjVdOiBTdXBwcmVzc2VkIDEw Nzk0NyBtZXNzYWdlcwpmcm9tIC9zeXN0ZW0uc2xpY2UvYXVkaXRkLnNlcnZpY2UKU2VwIDI4IDEz OjU3OjUxIHNlcnZlciBzeXN0ZW1kLWpvdXJuYWxbNTY1XTogU3VwcHJlc3NlZCAzMjc2MCBtZXNz YWdlcwpmcm9tIC9zeXN0ZW0uc2xpY2UvYXVkaXRkLnNlcnZpY2UKU2VwIDI4IDE3OjIxOjQwIHNl cnZlciBzeXN0ZW1kLWpvdXJuYWxbNTY1XTogU3VwcHJlc3NlZCAyMTAgbWVzc2FnZXMKZnJvbSAv c3lzdGVtLnNsaWNlL2F1ZGl0ZC5zZXJ2aWNlCk9jdCAwMSAwMjoxNjowMSBzZXJ2ZXIgc3lzdGVt ZC1qb3VybmFsWzU2NV06IFN1cHByZXNzZWQgMTMzMyBtZXNzYWdlcwpmcm9tIC9zeXN0ZW0uc2xp Y2UvYXVkaXRkLnNlcnZpY2UKCgoKam91cm5hbGN0bCAtLXZlcmlmeQpQQVNTOiAvcnVuL2xvZy9q b3VybmFsL2QyOGIwMDgwZmZlMDQzMmE5NzRmMzZlNGZiNGJmYTliL3N5c3RlbS5qb3VybmFsClBB U1M6Ci9ydW4vbG9nL2pvdXJuYWwvZDI4YjAwODBmZmUwNDMyYTk3NGYzNmU0ZmI0YmZhOWIvc3lz dGVtQDBkNDkyMjFkNjhkMDRlZjBiOTVkODIwM2M1ZTk2YTQ2LTAwMDAwMDAwMDA5N2Y2YzctMDAw NTU5NmI3NDViNGQxYy5qb3VybmFsClBBU1M6Ci9ydW4vbG9nL2pvdXJuYWwvZDI4YjAwODBmZmUw NDMyYTk3NGYzNmU0ZmI0YmZhOWIvc3lzdGVtQDBkNDkyMjFkNjhkMDRlZjBiOTVkODIwM2M1ZTk2 YTQ2LTAwMDAwMDAwMDA5NmE1ODctMDAwNTU5NjZmMzVhZTU5YS5qb3VybmFsClBBU1M6Ci9ydW4v bG9nL2pvdXJuYWwvZDI4YjAwODBmZmUwNDMyYTk3NGYzNmU0ZmI0YmZhOWIvc3lzdGVtQDBkNDky MjFkNjhkMDRlZjBiOTVkODIwM2M1ZTk2YTQ2LTAwMDAwMDAwMDA5NTU0ZjEtMDAwNTU5NjI5YzRj ZGI3ZS5qb3VybmFsClBBU1M6Ci9ydW4vbG9nL2pvdXJuYWwvZDI4YjAwODBmZmUwNDMyYTk3NGYz NmU0ZmI0YmZhOWIvc3lzdGVtQDBkNDkyMjFkNjhkMDRlZjBiOTVkODIwM2M1ZTk2YTQ2LTAwMDAw MDAwMDA5NDA1OTEtMDAwNTU5NWUxODExYTJkMS5qb3VybmFsClBBU1M6Ci9ydW4vbG9nL2pvdXJu YWwvZDI4YjAwODBmZmUwNDMyYTk3NGYzNmU0ZmI0YmZhOWIvc3lzdGVtQDBkNDkyMjFkNjhkMDRl ZjBiOTVkODIwM2M1ZTk2YTQ2LTAwMDAwMDAwMDA5MmI1MDAtMDAwNTU5NTlmMmRlNWVkZS5qb3Vy bmFsClBBU1M6Ci9ydW4vbG9nL2pvdXJuYWwvZDI4YjAwODBmZmUwNDMyYTk3NGYzNmU0ZmI0YmZh OWIvc3lzdGVtQDBkNDkyMjFkNjhkMDRlZjBiOTVkODIwM2M1ZTk2YTQ2LTAwMDAwMDAwMDA5MTY0 NzktMDAwNTU5NTU3MzEzN2I3NC5qb3VybmFsClBBU1M6Ci9ydW4vbG9nL2pvdXJuYWwvZDI4YjAw ODBmZmUwNDMyYTk3NGYzNmU0ZmI0YmZhOWIvc3lzdGVtQDBkNDkyMjFkNjhkMDRlZjBiOTVkODIw M2M1ZTk2YTQ2LTAwMDAwMDAwMDA5MDEzMzctMDAwNTU5NTBkODBjYzNkOC5qb3VybmFsClBBU1M6 Ci9ydW4vbG9nL2pvdXJuYWwvZDI4YjAwODBmZmUwNDMyYTk3NGYzNmU0ZmI0YmZhOWIvc3lzdGVt QDBkNDkyMjFkNjhkMDRlZjBiOTVkODIwM2M1ZTk2YTQ2LTAwMDAwMDAwMDA4ZWMyZmItMDAwNTU5 NGNhZDE0YjA3YS5qb3VybmFsClBBU1M6Ci9ydW4vbG9nL2pvdXJuYWwvZDI4YjAwODBmZmUwNDMy YTk3NGYzNmU0ZmI0YmZhOWIvc3lzdGVtQDBkNDkyMjFkNjhkMDRlZjBiOTVkODIwM2M1ZTk2YTQ2 LTAwMDAwMDAwMDA4ZDczNzMtMDAwNTU5NDgzODY4M2U1OC5qb3VybmFsClBBU1M6Ci9ydW4vbG9n L2pvdXJuYWwvZDI4YjAwODBmZmUwNDMyYTk3NGYzNmU0ZmI0YmZhOWIvc3lzdGVtQDBkNDkyMjFk NjhkMDRlZjBiOTVkODIwM2M1ZTk2YTQ2LTAwMDAwMDAwMDA4YzIzOGUtMDAwNTU5NDNmZTIwNzJl My5qb3VybmFsClBBU1M6Ci9ydW4vbG9nL2pvdXJuYWwvZDI4YjAwODBmZmUwNDMyYTk3NGYzNmU0 ZmI0YmZhOWIvc3lzdGVtQDBkNDkyMjFkNjhkMDRlZjBiOTVkODIwM2M1ZTk2YTQ2LTAwMDAwMDAw MDA4YWQxZDktMDAwNTU5M2ZmNjRhNGY2OS5qb3VybmFsClBBU1M6Ci9ydW4vbG9nL2pvdXJuYWwv ZDI4YjAwODBmZmUwNDMyYTk3NGYzNmU0ZmI0YmZhOWIvc3lzdGVtQDBkNDkyMjFkNjhkMDRlZjBi OTVkODIwM2M1ZTk2YTQ2LTAwMDAwMDAwMDA4OTdmMzItMDAwNTU5M2UxOGM1NzU4Yi5qb3VybmFs CgoKam91cm5hbGN0bCAtLWRpc2stdXNhZ2UKQXJjaGl2ZWQgYW5kIGFjdGl2ZSBqb3VybmFscyB0 YWtlIHVwIDEuMUcgb24gZGlzay4KCgpJbml0aWFsbHkgd2Ugc2F3OgoxNjczMyBQQVRICjUwNzAg U1lTQ0FMTAo1MDI0IENXRAozNzY1IEFWQwozMjMgQ1JZUFRPX0tFWV9VU0VSCjIyMyBVU0VSX1NU QVJUCjIyMiBVU0VSX0FDQ1QKMjIyIENSRURfQUNRCjIyMCBMT0dJTgoyMjAgQ1JFRF9SRUZSCjIx OCBVU0VSX0VORAoyMTggQ1JFRF9ESVNQCjQ2IFVTRVJfTE9HSU4KMTIgRVhFQ1ZFCjQgVVNFUl9B VVRICjIgQ1JZUFRPX1NFU1NJT04KMSBVU0VSX1JPTEVfQ0hBTkdFCjEgVVNFUl9DTUQKMSBTRVJW SUNFX1NUT1AKMSBTRVJWSUNFX1NUQVJUCjEgQlBSTV9GQ0FQUwoKc28gd2UgYmxvY2tlZCB0eXBl IFBBVEggaW4gYXVkaXQucnVsZXMKCkJ1dCB3ZSBhcmUgc3RpbGwgc2VlaW5nIDEwMEsgb2YgZHJv cHBlZC9zdXBwcmVzc2VkIG1lc3NhZ2VzLgoKTm90ZTogc3lzdGVtbG9nbGV2ZWwgPSBJTkZPCgpD ZW50b3MgNyAxNzA4IDMuMTAuMC02OTMuMi4yLmVsNy54ODZfNjQKCnN5c3RlbWQueDg2XzY0ICAg ICAgICAgICAgICAgICAgICAgIDIxOS00Mi5lbDdfNC4xCgoKTm93IHdlIGFyZSByZXF1aXJlZCB0 byBoYXZlIGZ1bGwgYXVkaXQgcnVsZXMgYW5kIGRvZXMgdGhpcyBsb29rIGxpa2UgYXQKcmF0ZSBs aW1pdGluZyBpc3N1ZSBvciBhbiBpc3N1ZSBvZiBqb3VybmFsIG5vdCBhYmxlIHRvIGhhbmRsZSB0 aGUKdHJhZmZpYyB0byBsb2dnaW5nPwoKRXJyb3Igd2UgYXJlIHNlZWluZyBmcm9tIHNlcnZpY2Vz IHRoYXQgaGF2ZSBzaWxlbnRseSBmYWlsZWQsIGluIHRoaXMKY2FzZSBnbGFzc2Zpc2guLgoKc3lz dGVtY3RsIHN0YXR1cyAtbCBnbGFzc2Zpc2gK4pePIGdsYXNzZmlzaC5zZXJ2aWNlIC0gU1lTVjog R2xhc3NGaXNoIHN0YXJ0IGFuZCBzdG9wICBkYWVtb24KICAgTG9hZGVkOiBsb2FkZWQgKC9ldGMv cmMuZC9pbml0LmQvZ2xhc3NmaXNoOyBiYWQ7IHZlbmRvciBwcmVzZXQ6IGRpc2FibGVkKQogICBB Y3RpdmU6IGFjdGl2ZSAoZXhpdGVkKSBzaW5jZSBUdWUgMjAxNy0wOS0yNiAyMDowMTozNiBVVEM7 IDUgZGF5cyBhZ28KICAgICBEb2NzOiBtYW46c3lzdGVtZC1zeXN2LWdlbmVyYXRvcig4KQogIFBy b2Nlc3M6IDEzMjggRXhlY1N0YXJ0PS9ldGMvcmMuZC9pbml0LmQvZ2xhc3NmaXNoIHN0YXJ0IChj b2RlPWV4aXRlZCwKc3RhdHVzPTAvU1VDQ0VTUykKCldhcm5pbmc6IEpvdXJuYWwgaGFzIGJlZW4g cm90YXRlZCBzaW5jZSB1bml0IHdhcyBzdGFydGVkLiBMb2cgb3V0cHV0IGlzCmluY29tcGxldGUg b3IgdW5hdmFpbGFibGUuCgpFdmVudHVhbGx5IGdsYXNzZmlzaCB3aWxsIGZhaWwgYnV0IGl0IHdv bnQga2lsbCB0aGUgc2VydmljZSBzbyB3ZSBuZXZlcgpnZXQgYW4gbm1zIHNlcnZpY2UgZG93biB0 cmFwIGZyb20gdGhlIE9JRC4KClBsZWFzZSBsZXQgbWUga25vdyBpZiBmdXJ0aGVyIGluZm8gaXMg bmVlZGVkIG9yIGlmIGNlcnRhaW4gbGltaXRzIG5lZWQKdG8gYmUgYWRqdXN0ZWQuCgpUaGFua3Ms CkJyYWQgWnluZGEKCgotLQpMaW51eC1hdWRpdCBtYWlsaW5nIGxpc3QKTGludXgtYXVkaXRAcmVk aGF0LmNvbQpodHRwczovL3d3dy5yZWRoYXQuY29tL21haWxtYW4vbGlzdGluZm8vbGludXgtYXVk aXQ=