[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

auid bug



I am receiving audit events with an odd auid... I am not sure if this is something wrong in the kernel or in audit. The auid I am receiving is 4294967295 (the max value for an unsigned long). The other uid/gid information is normal.

I have seen this on all audit versions since audit-1.2.3, and noticed it using the following kernels:

2.6.17-1.2293.2.2_FC6.lspp.38.i686
2.6.17-1.2293.2.2_FC6.lspp.44.i686

The first time I noticed this was after the filter_key patch I applied to audit-1.2.3, but it may have nothing to do with that patch. I mentioned it then:

https://www.redhat.com/archives/linux-audit/2006-June/msg00086.html

There is an example record from the audit dispatcher there.

These events are coming straight from the real-time audit dispatcher.

Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]