Bug 1232565

Summary: Lots of **Unmatched Entries** in logwatch Kernel Audit
Product: [Fedora] Fedora Reporter: John Saalwaechter <saalwaechter>
Component: logwatchAssignee: Jan Synacek <jsynacek>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 22CC: frank, herrold, jsynacek, philipp, richardfearn, varekova
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-06-17 06:26:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description John Saalwaechter 2015-06-17 04:01:46 UTC
Description of problem:
Lots of unmatched entries in Kernel Audit logwatch reports in F22

Version-Release number of selected component (if applicable):
F22 & logwatch-7.4.1-2.20140924svn242.fc22.noarch

How reproducible:
100%

Steps to Reproduce:
1. Install F22 and enable logwatch
2. Get daily logwatch reports with huge Kernel Audit sections that start with "**Unmatched Entries** (Only first 100 out of 1290 are printed)"

Additional info:
This patch seems to help:

--- /usr/share/logwatch/scripts/services/audit.orig     2015-06-16 20:32:28.654461680 -0700
+++ /usr/share/logwatch/scripts/services/audit  2015-06-16 20:46:56.216340470 -0700
@@ -126,6 +126,7 @@
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=1 uid=0 auid=[0-9]* ses=[0-9]* subj=system_u:system_r:init_t:s0 .* res=success/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 auid=[0-9]* ses=[0-9]*$/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 auid=[0-9]* ses=[0-9]* subj=.*res=success/) or
+        ( $ThisLine =~ /<audit-\d+> pid=\d+ uid=\d+ auid=\d+ ses=\d+ subj=.*res=success/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 old auid=[0-9]* new auid=[0-9]+ old ses=[0-9]* new ses=[0-9]+ res=1$/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\):  cwd=".*"/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): user/) or

Comment 1 Jan Synacek 2015-06-17 06:26:46 UTC

*** This bug has been marked as a duplicate of bug 1231364 ***