Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.

Bug 160338

Summary: Audit not installed during upgrade from FC3 when selinux disabled
Product: [Fedora] Fedora Reporter: Emerson House <ehbase-linux>
Component: auditAssignee: Steve Grubb <sgrubb>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 4   
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-06-14 15:43:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Emerson House 2005-06-14 15:18:45 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050524 Fedora/1.0.4-4 Firefox/1.0.4

Description of problem:
Audit not installed on system during upgrade from functional FC4.  Selinux disabled on FC3 system.

Kernel messages, or at least service startup, error and shutdown messages, 
disapear from system logs.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.Upgrade FC3 to FC4

Actual Results:  Upgraded system works, but service startup, error and shutdown messages
disapear from system logs.

Expected Results:  From Release Notes auditd should be installed and enabled on FC4 system.  At least  
some system messages are apparently directed to the audit.log.

Additional info:

Use yum to install audit!

Comment 1 Steve Grubb 2005-06-14 15:25:59 UTC
I didn't write the release notes, so it may be wrong.

Audit does not need to be installed for the system to work. audit-libs does need
to be installed for pam and dbus. Did that package get installed?

auditd only records auditable events from trusted programs. It does not record
service startup or shutdown. This is done by syslogd. Messages should be
controlled by /etc/syslogd.conf.

Comment 2 Emerson House 2005-06-14 15:43:37 UTC
You are right audit log does not get these error messages.  audit-libs is installed.

Syslog.conf is dated August 2004, I think it is from FC1 installation and has
not been changed.  Boot.log still gets startup messages but not service startup
or shutdown messages.

Release Notes do indicate audit should be installed, but otherwise the upgraded
system did seem to work.