Bug 178102

Summary:	ausearch not translating the uid field in USER_LOGIN message
Product:	Red Hat Enterprise Linux 4	Reporter:	Suzanne Hillman <shillman>
Component:	audit	Assignee:	Steve Grubb <sgrubb>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.3
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	RHBA-2006-0379	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-08-10 21:16:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	176155, 181409

Description Suzanne Hillman 2006-01-17 20:26:03 UTC

Description of problem:
uid not translated to username when "ausearch -m USER_LOGIN -x gdm -i" is run,
like so:

type=USER_LOGIN msg=audit(01/17/2006 11:40:05.304:27) : user pid=4506
uid=root auid=unknown(4294967295) msg='uid=500: exe="/usr/bin/gdm-binary"
(hostname=dhcp83-11.boston.redhat.com, addr=172.16.83.11, terminal=:0
res=success)'

Version-Release number of selected component (if applicable):
audit-1.0.12-1.EL4.x86_64.rpm

How reproducible:
Always.

Steps to Reproduce:
1. Enable audit, then login via gdm.
2. Run "ausearch -m USER_LOGIN -x gdm -i" in a terminal window
  
Actual results:
uid not translated from the number.

Expected results:
Should be username instead of uid.

Additional info:

Comment 1 Steve Grubb 2006-02-09 14:46:49 UTC

This is fixed in 1.0.14.

Comment 5 Bob Johnson 2006-04-11 16:11:21 UTC

This issue is on Red Hat Engineering's list of planned work items 
for the upcoming Red Hat Enterprise Linux 4.4 release.  Engineering 
resources have been assigned and barring unforeseen circumstances, Red 
Hat intends to include this item in the 4.4 release.

Comment 9 Red Hat Bugzilla 2006-08-10 21:16:51 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2006-0379.html