[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: auid bug

Are you sure you have pam_loginuid.so configured in the appropriate
/etc/pam.d/* files, such as login and sshd?

I checked the login file and it matches yours, I am not using ssh on this machine.

I'm running the .41 kernel and the audit-1.2.4 tools and
the auid is correct in the audit records on my system.

Most of the time, mine is correct as well. It seems to occur sporadically. Usually, a reboot will fix the problem.


I am receiving audit events with an odd auid...  I am not sure if this
is something wrong in the kernel or in audit.  The auid I am receiving
is 4294967295 (the max value for an unsigned long).  The other uid/gid
information is normal.

I have seen this on all audit versions since audit-1.2.3, and noticed it
using the following kernels:


The first time I noticed this was after the filter_key patch I applied
to audit-1.2.3, but it may have nothing to do with that patch.  I
mentioned it then:


There is an example record from the audit dispatcher there.

These events are coming straight from the real-time audit dispatcher.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]