Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 991056 - ausearch ignores USER events with -ua option
Summary: ausearch ignores USER events with -ua option
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: audit
Version: 7.0
Hardware: All
OS: Linux
Target Milestone: beta
: 7.0
Assignee: Steve Grubb
QA Contact: Ondrej Moriš
Depends On:
Blocks: RHEL7CCC 994381
TreeView+ depends on / blocked
Reported: 2013-08-01 13:29 UTC by Ondrej Moriš
Modified: 2014-06-13 12:40 UTC (History)
0 users

Fixed In Version: audit-2.3.2-2.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-06-13 12:40:35 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Ondrej Moriš 2013-08-01 13:29:41 UTC
Description of problem:

Since 2.3.2-1  ausearch ignores (at least) USER event types when it is invoked with -ua option. Unfortunately I am unable to map changes in 2.3.2-1 onto upstream, I just not see them there. 

I see USER record type has been removed (and not only it) from extract_search_items function in ausearch-parse.c (even though it did not happened in upstream - Adding USER type back to switch statement solved the issue.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:

0. cat >audit.test<<EOF
   type=USER msg=audit(1133817257.347:49948): user pid=25504 uid=0 auid=10208 msg='testing 1-2-3 testing'

1. ausearch -if audit.test -ua 10208 

Actual results:

<no matches>

Expected results:

time->Mon Dec  5 22:14:17 2005
type=USER msg=audit(1133817257.347:49948): user pid=25504 uid=0 auid=10208 msg='testing 1-2-3 testing'

Additional info:

In previous version (2.3.1-4) it works fine.

Comment 1 Steve Grubb 2013-08-01 13:41:42 UTC
The svn browser is somewhat broken. I have asked before why its not working and fedora admins did something to make it work. But I guess it didn't last long. I'll ask again to get it working off current code.

I started to remove AUDIT_USER from support because a comment in /usr/include/linux/audit.h says that its deprecated. But its not. So, the issue is that one more place was missed when restoring its support. Fixed in SVN. I will be doing another rebase to fix the problems reported on needs rewriting almost from scratch.

Comment 2 Steve Grubb 2013-08-29 19:26:09 UTC
Fixed in audit-2.3.2-2.el7.

Comment 3 Ondrej Moriš 2013-08-30 08:07:54 UTC
Successfully verified.

Comment 4 Ludek Smid 2014-06-13 12:40:35 UTC
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.