Bug 128164

Summary: Kernel error: Filter target 0x203 not known or not supported in this context
Product: Red Hat Enterprise Linux 3 Reporter: Sharon Smith <sharon.smith>
Component: lausAssignee: Peter Martuccelli <peterm>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 3.0CC: bugproxy, deepak.patel, garyhade, glen.foster, hongjiu.lu, jlaska, mary.laser, petrides, rick.hester, riel, tao, tim.chambers
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-09-02 04:32:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 116727    
Bug Blocks:    

Description Sharon Smith 2004-07-19 15:12:06 UTC
Description of problem: The following message: "Filter target 0x203
not known or not supported in this context" appears 2-4 times on the
console on the hour.  


Version-Release number of selected component (if applicable): Kernel
2.4.21-17.EL


How reproducible: This error has been seen across various platforms
after full/default/min installs.  It seems to show up hourly.  When
viewing /var/log/messages I get the following message: "Jul 19
01:01:00 titanic last message repeated 2 times" on our machine
titanic.test.  We may have tracked it down to the cron.hourly processes.  


Steps to Reproduce:
1.Do any of a full, default, or minimal installation on an ia64 box
2.Wait for (what's suspected to be) cron processes to begin
3.Recieve: "Filter target 0x203 not known or not supported in this
context" error twice
  
Actual results: Filter target 0x203 not known or not supported in this
context


Expected results: No error


Additional info:

Comment 1 Sharon Smith 2004-07-19 15:14:15 UTC
Sorry, part of my copy and paste didn't make it.  The message in
/var/log/messages should have read:

Jul 18 04:02:08 titanic kernel: Filter target 0x203 not known or not
supported i n this context
Jul 18 05:01:00 titanic last message repeated 4 times

Generally, this message is only repeated twice though.  

Comment 2 Jay Turner 2004-07-21 00:33:43 UTC
*** Bug 128150 has been marked as a duplicate of this bug. ***

Comment 3 Jay Turner 2004-07-21 10:46:08 UTC
*** Bug 128278 has been marked as a duplicate of this bug. ***

Comment 4 Charlie Bennett 2004-07-21 14:26:57 UTC
This problem is in the kernel audit driver's filter handling code.  It
appears whenever an attempt is made to audit open() on a non-existent
file.

Comment 5 Larry Troan 2004-07-26 12:27:48 UTC
amit_bhutani,
On 7/21/2004, you restrcted this bug to Dell and Linux_Enterprise_Beta
though it was opened as a public bug by HP on 7/19/2004. 

Since there is nothng Dell Confidential in this bug at this time, I am
reopening it to HP. If this is a problem, you will need to get
information through an Issue Tracker tied to this bug by having your
TAM opening it up to you. 

Comment 6 Amit Bhutani 2004-07-26 14:03:35 UTC
Nothing confidential here. The restriction must have been an error.

Comment 7 Ernie Petrides 2004-08-03 22:49:04 UTC
I'm removing the access restrictions per Amit's response above.  -ernie

Comment 8 Ernie Petrides 2004-08-03 22:51:52 UTC
*** Bug 128931 has been marked as a duplicate of this bug. ***

Comment 9 Larry Troan 2004-08-04 18:49:12 UTC
Removing access restrictions again.

Comment 10 Ernie Petrides 2004-08-05 23:15:49 UTC
*** Bug 129173 has been marked as a duplicate of this bug. ***

Comment 11 Ernie Petrides 2004-08-05 23:50:35 UTC
*** Bug 129256 has been marked as a duplicate of this bug. ***

Comment 15 Peter Martuccelli 2004-08-11 14:59:26 UTC
This was an open issue from the IBM audit which was not required for
certification.  It was moved onto the must fix list on Monday so it
will be included in U3.  HP by default will get the fix since their
kernels will be based on U3.

Dell has the issue marked as a P2, they will receive the fix in U3. 
The issue is more of an annoyance due to the console logging, it does
not affect EAL3 certification.

Comment 16 Ernie Petrides 2004-08-13 04:36:57 UTC
A fix for this problem has just been committed to the RHEL3 U3
patch pool this evening (in kernel version 2.4.21-19.EL).


Comment 17 Amit Bhutani 2004-08-19 20:09:06 UTC
Appears fixed in -19 kernel testing.

Comment 18 John Flanagan 2004-09-02 04:32:06 UTC
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2004-433.html


Comment 19 Sharon Smith 2004-09-15 20:26:36 UTC
I would just like to verify for you that this errata has solved the
problem.