Bug 1327286

Summary: login report only shows auid=0
Product: Red Hat Enterprise Linux 6 Reporter: Bryan Harris <bryanlharris>
Component: auditAssignee: Steve Grubb <sgrubb>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.7CC: nparmar, pvrabec
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-04-18 16:44:10 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Bryan Harris 2016-04-14 16:50:13 UTC 
Description of problem:
When I do the below three commands the auid shown back to me is not
the same from all the commands, but it's the same event.  In the first
aureport I'm getting back an auid of zero for root.  In the second
aureport I get back my teammate's auid.  Also in the ausearch for the
specific event I get my teammate's auid.  I would expect my teammate's
auid across all but that's not what I see.

It seems the first aureport replaces the auid with uid.

I asked on the mailing list but it's moderated and I haven't gotten through yet.

Version-Release number of selected component (if applicable):
audit-2.3.7-5.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1. aureport -l # and look at auid
2. aureport -l --summary # look at auid
3. ausearch --message USER_LOGIN # look at auid

Actual results:
Sometimes the auid matches what was in that log entry and sometimes it matches the uid of that log entry.

Expected results:
I would expect auid to always be reported as it was in the actual log entry.

Additional info:
N/a
Comment 3 Steve Grubb 2016-04-18 16:44:10 UTC 
This is fixed in audit-2.4.1.

https://fedorahosted.org/audit/changeset/1047

Closing on the rebase bug since it fixes the issue.

*** This bug has been marked as a duplicate of bug 1257650 ***