Description of problem: The following message: "Filter target 0x203 not known or not supported in this context" appears 2-4 times on the console on the hour. Version-Release number of selected component (if applicable): Kernel 2.4.21-17.EL How reproducible: This error has been seen across various platforms after full/default/min installs. It seems to show up hourly. When viewing /var/log/messages I get the following message: "Jul 19 01:01:00 titanic last message repeated 2 times" on our machine titanic.test. We may have tracked it down to the cron.hourly processes. Steps to Reproduce: 1.Do any of a full, default, or minimal installation on an ia64 box 2.Wait for (what's suspected to be) cron processes to begin 3.Recieve: "Filter target 0x203 not known or not supported in this context" error twice Actual results: Filter target 0x203 not known or not supported in this context Expected results: No error Additional info:
Sorry, part of my copy and paste didn't make it. The message in /var/log/messages should have read: Jul 18 04:02:08 titanic kernel: Filter target 0x203 not known or not supported i n this context Jul 18 05:01:00 titanic last message repeated 4 times Generally, this message is only repeated twice though.
*** Bug 128150 has been marked as a duplicate of this bug. ***
*** Bug 128278 has been marked as a duplicate of this bug. ***
This problem is in the kernel audit driver's filter handling code. It appears whenever an attempt is made to audit open() on a non-existent file.
amit_bhutani, On 7/21/2004, you restrcted this bug to Dell and Linux_Enterprise_Beta though it was opened as a public bug by HP on 7/19/2004. Since there is nothng Dell Confidential in this bug at this time, I am reopening it to HP. If this is a problem, you will need to get information through an Issue Tracker tied to this bug by having your TAM opening it up to you.
Nothing confidential here. The restriction must have been an error.
I'm removing the access restrictions per Amit's response above. -ernie
*** Bug 128931 has been marked as a duplicate of this bug. ***
Removing access restrictions again.
*** Bug 129173 has been marked as a duplicate of this bug. ***
*** Bug 129256 has been marked as a duplicate of this bug. ***
This was an open issue from the IBM audit which was not required for certification. It was moved onto the must fix list on Monday so it will be included in U3. HP by default will get the fix since their kernels will be based on U3. Dell has the issue marked as a P2, they will receive the fix in U3. The issue is more of an annoyance due to the console logging, it does not affect EAL3 certification.
A fix for this problem has just been committed to the RHEL3 U3 patch pool this evening (in kernel version 2.4.21-19.EL).
Appears fixed in -19 kernel testing.
An errata has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2004-433.html
I would just like to verify for you that this errata has solved the problem.